Video Generation Automatic

PassAudited by ClawScan on May 6, 2026.

Overview

The skill is coherently a cloud video-generation integration, but users should notice that it automatically connects to an external backend, uses a bearer token, and uploads user-provided media for remote processing.

This skill does what it advertises using a cloud backend. Before installing, be comfortable with automatic connection to mega-api-prod.nemovideo.ai, bearer-token use, and remote processing of uploaded text/images/audio/video. Prefer non-sensitive media unless you have reviewed the provider’s privacy and retention practices.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Opening or using the skill can contact the NemoVideo backend and create a remote editing session.

Why it was flagged

The skill makes network/API calls automatically during setup. This is expected for a cloud video-generation skill, but it is still behavior the user should be aware of.

Skill content
When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").
Recommendation

Use the skill only if you are comfortable with automatic setup calls to the listed backend; ask the agent to confirm before uploads or exports if you want tighter control.

What this means

The token can authorize video-generation sessions and credit usage with the provider.

Why it was flagged

The skill uses a bearer token for the video service and can obtain an anonymous token if one is not already configured. That is purpose-aligned but grants access to the remote service session and credits.

Skill content
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... If it is [not set] ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... The response `data.token` is your NEMO_TOKEN
Recommendation

Keep NEMO_TOKEN private, avoid exposing logs or environment dumps, and rotate/remove the token if you no longer use the skill.

What this means

Any media or prompts you provide for generation may leave your device and be processed by the NemoVideo cloud backend.

Why it was flagged

User-provided text, images, video, or audio are sent to an external cloud provider for rendering. This is central to the skill purpose, but it is a sensitive data boundary.

Skill content
Send me your text or images and describe the result you want. The automatic video creation runs on remote GPU nodes ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file
Recommendation

Do not upload confidential, regulated, or private media unless you trust the provider and its handling of uploaded content.