Video Generator Online

PassAudited by VirusTotal on May 1, 2026.

Overview

Type: OpenClaw Skill Name: video-generator-online Version: 1.0.0 The video-generator-online skill is a legitimate integration for the nemovideo.ai service, enabling users to generate videos from text or images. It manages authentication via the NEMO_TOKEN environment variable or an anonymous token endpoint, handles file uploads, and interacts with a cloud-based rendering pipeline. The instructions in SKILL.md are transparent, focused on the stated purpose, and include appropriate security practices such as advising the agent not to print raw tokens or JSON. No indicators of malicious intent, data exfiltration, or unauthorized execution were found.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill will contact the Nemo video API and create a processing session before generating videos.

Why it was flagged

The skill starts a remote API session automatically when used. This is aligned with its cloud-rendering purpose, but it is an external action users should be aware of.

Skill content
On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".
Recommendation

Use the skill only when you intend to use the external video service, and review any credit or subscription impact before requesting renders or exports.

What this means

If you provide a paid or registered Nemo token, the skill may use that account's credits or service permissions for generation and export requests.

Why it was flagged

The skill requires a bearer token for the Nemo video service. This is expected for the integration, but it gives the skill authority to act against that service account or token balance.

Skill content
All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use a dedicated or limited token where possible, do not provide unrelated secrets, and monitor credit usage.

What this means

Text, images, video, and audio provided for generation may leave the local environment and be processed by the provider.

Why it was flagged

The workflow sends user prompts and uploaded media to an external cloud video provider. This is disclosed and central to the skill, but it affects privacy for any sensitive content.

Skill content
Drop your text or images in the chat and tell me what you need. I'll handle the AI video creation on cloud GPUs
Recommendation

Avoid uploading confidential, regulated, or third-party-sensitive media unless you trust the provider and have checked its data-handling terms.

What this means

Users have limited registry-provided information to independently verify who operates the skill or the linked service.

Why it was flagged

The registry does not provide an external source or homepage for verifying the publisher or service provenance. There is no local code or install script, so this is a provenance note rather than a concrete execution concern.

Skill content
Source: unknown; Homepage: none
Recommendation

Check the skill owner, service domain, and provider policies before using it with important accounts or sensitive media.