Text To Video Hunyuan

PassAudited by ClawScan on Apr 30, 2026.

Overview

This skill appears aligned with remote text-to-video generation, but it sends prompts and uploaded media to an external NemoVideo service and uses a token/session to do so.

Before installing, confirm you are comfortable using the NemoVideo backend, sending it your prompts and media, and using a NEMO_TOKEN that may consume free or paid credits. Avoid confidential media unless you trust the provider's data handling, and monitor render jobs and credit balance during exports.

Findings (6)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your prompt and any uploaded media may be processed by the remote service to generate and export videos.

Why it was flagged

The skill exposes remote API actions for streaming generation, uploading media, and starting exports. These are powerful but disclosed and directly related to the text-to-video purpose.

Skill content
Base URL: `https://mega-api-prod.nemovideo.ai` ... `/run_sse` ... `/api/upload-video/nemo_agent/me/<sid>` ... `/api/render/proxy/lambda`
Recommendation

Use it only for content you are comfortable sending to the NemoVideo backend, and review generated/exported results before sharing them.

What this means

The skill can act against the NemoVideo service using the configured or generated token, including consuming credits for generation/export workflows.

Why it was flagged

The skill requires and uses a bearer token for the remote provider. This credential use is expected for the service and no artifact shows unrelated access or token disclosure.

Skill content
Check if `NEMO_TOKEN` is set in the environment ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... `data.token` is your NEMO_TOKEN ... `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Keep NEMO_TOKEN private, use a dedicated token when possible, and monitor credits or account activity with the provider.

What this means

You have less registry-provided context for verifying who maintains the skill or the external service it uses.

Why it was flagged

The skill is instruction-only but relies on an external service, and the registry metadata does not provide a clear source or homepage for provenance review.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider and domain before using sensitive prompts, private media, or paid credits.

What this means

Prompts, generated media references, drafts, and session identifiers may remain associated with the remote editing session.

Why it was flagged

The skill maintains provider session state and retrieves timeline/media state. This is purpose-aligned, but it means task context can persist across requests within the session.

Skill content
Store the returned `session_id` for all subsequent requests ... `/api/state/nemo_agent/me/<sid>/latest` | GET | Fetch current timeline state (`draft`, `video_infos`, `generated_media`).
Recommendation

Avoid submitting confidential content unless you are comfortable with it being stored in the provider session, and start a new session when separating unrelated projects.

What this means

Uploaded videos, images, audio, URLs, and prompts may be visible to or processed by the external backend.

Why it was flagged

The skill can transmit user-provided files or URLs to an external provider. The boundary is disclosed and central to the video workflow, but users should recognize the data-sharing implication.

Skill content
`/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL ... Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.
Recommendation

Do not upload private, regulated, or third-party-confidential media unless you have confirmed the provider's data handling terms.

What this means

A render may continue or become difficult to track if the session is interrupted, potentially affecting credits or completion tracking.

Why it was flagged

The skill discloses that render jobs can outlive the local interaction. This is not unusual for cloud rendering, but it is a lifecycle/containment behavior users should notice.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Keep the session open while exports are running and check job status or credits if a render is interrupted.