Ai Animation Creator

PassAudited by ClawScan on May 16, 2026.

Overview

This appears to be a coherent cloud animation skill, but it will use or create a NemoVideo token and send selected prompts/media to nemovideo.ai for processing.

Install only if you are comfortable sending selected animation inputs to nemovideo.ai. Use non-sensitive media, keep NEMO_TOKEN private, and confirm any large upload or export workflow before proceeding.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent will authenticate to the provider service on the user's behalf, potentially using free credits or any token supplied by the user.

Why it was flagged

The skill uses a bearer token for the NemoVideo service and can automatically request an anonymous token if one is not already present.

Skill content

Look for `NEMO_TOKEN` in the environment. If found, skip to session creation. Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Extract `data.token`

Recommendation

Use a dedicated NemoVideo token if possible, understand the anonymous-token behavior, and do not share the token in chats or logs.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Images, videos, audio, URLs, and prompt text selected for animation may leave the local environment and be processed by nemovideo.ai.

Why it was flagged

The skill explicitly sends user-provided files, URLs, and prompts to an external cloud provider for rendering.

Skill content

This skill connects to a cloud processing backend... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`

Recommendation

Avoid uploading private, confidential, or rights-sensitive media unless you trust the provider and its data handling terms.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The user may not see every internal provider API step the agent takes while generating, editing, or exporting the animation.

Why it was flagged

Backend responses can drive follow-on API actions inside the provider workflow, though the visible actions are scoped to the animation service.

Skill content

Tool calls stay internal... "click" or "点击" → execute the action via the relevant endpoint ... "Export" or "导出" → run the export workflow

Recommendation

Use the skill for its intended render workflow and ask the agent to confirm before large uploads, exports, or credit-consuming actions.