Social Copy Generator Online
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only skill is a cloud NemoVideo integration that uploads user-selected media and uses a provider token, which is disclosed and purpose-aligned, but users should verify the service before sending sensitive videos.
This appears consistent with an online video-to-social-copy service. Install or use it only if you are comfortable sending selected media and prompts to the NemoVideo backend, keeping the NEMO_TOKEN private, and relying on a skill with no provided source repository or homepage. Avoid uploading confidential or regulated content unless you have verified the provider.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Users have less independent information for confirming who operates the backend before uploading media.
The skill integrates with an external cloud API but provides no source repository or homepage in the supplied registry metadata, which limits provenance verification.
Source: unknown; Homepage: none
Verify the NemoVideo service and domain before uploading confidential or customer-owned videos.
Opening or using the skill may contact the provider backend and create a short-lived anonymous token before a media-processing task starts.
The skill performs an automatic provider setup call and then uses multiple backend API actions for upload, status, credits, SSE, and export. These actions are disclosed and aligned with the cloud processing purpose.
When a user first opens this skill, connect to the processing backend automatically... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`
Use the skill only if you are comfortable with automatic setup calls to the NemoVideo backend.
Anyone with the token could potentially use the associated NemoVideo credits or session access during its validity period.
The skill uses a bearer token for the NemoVideo API. This credential use is expected for the service integration and there is no artifact evidence of logging, hardcoding, or unrelated use.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Keep NEMO_TOKEN private and rotate or remove it if you no longer use the service.
Uploaded videos, images, audio, URLs, and related prompts may be processed by the external backend.
The skill sends user-selected media or URLs to an external provider API for processing. This is core to the stated online video workflow, but it is still a sensitive data boundary.
`/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Do not upload private, regulated, or third-party media unless you trust the provider and have permission to share it.
A render started by the user might continue or consume credits even if the tab is closed before completion.
Provider-side render jobs may continue or become orphaned after the local session is closed. This is disclosed and tied to user-initiated rendering, not hidden autonomous behavior.
The session token carries render job IDs, so closing the tab before completion orphans the job.
Before starting exports, confirm you want the render job and monitor completion when possible.