Text To Video Gen

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a normal cloud text-to-video skill, but users should know it sends prompts and uploaded files to the NemoVideo API using a token-backed session.

This skill looks coherent for cloud text-to-video generation. Before using it, make sure you are comfortable sending prompts, uploaded files, and render requests to mega-api-prod.nemovideo.ai, and avoid providing sensitive documents unless you trust that provider.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill will initiate a remote provider session, even before the video request is fully processed.

Why it was flagged

The skill directs the agent to automatically contact the provider API when used. This is purpose-aligned for cloud video generation, but users should be aware that API activity starts as part of the workflow.

Skill content
Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".
Recommendation

Use only if you are comfortable with the agent contacting the NemoVideo backend for this task; ask the agent to explain steps before upload or export if you want more visibility.

What this means

The provider token may authorize video-generation sessions, credits, and render jobs for the NemoVideo service.

Why it was flagged

The skill uses a bearer token to authorize provider API calls. This is expected for the stated service integration and there is no evidence of token leakage or unrelated use.

Skill content
Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request
Recommendation

Provide only the intended NemoVideo token, keep it scoped to this service, and rotate or revoke it if you no longer use the skill.

What this means

Text prompts and uploaded documents or media may be processed by NemoVideo’s cloud service.

Why it was flagged

The skill sends prompts and user-selected files to an external provider API. This is central to the text-to-video workflow, but it means user content leaves the local environment.

Skill content
**Send message (SSE)**: POST `/run_sse` ... `new_message` ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Recommendation

Avoid uploading confidential, regulated, or proprietary documents unless you trust the provider’s data handling terms.