Ai Video Editor Content Creator

PassAudited by ClawScan on May 5, 2026.

Overview

This appears to be a coherent cloud video-editing skill, but it will use a NemoVideo token/session and send uploaded footage and prompts to NemoVideo's remote API.

This looks purpose-aligned for cloud video editing. Before installing, understand that it will contact mega-api-prod.nemovideo.ai, create or use a NEMO_TOKEN session, upload your footage for remote processing, and return cloud-hosted exports. Do not use it for footage you cannot share with that provider.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private or unpublished footage may leave the user's device and be processed by NemoVideo's servers.

Why it was flagged

The skill is explicitly designed to send user video content and edit instructions to a third-party cloud service for processing.

Skill content
“Send me your raw video footage and describe the result you want. The AI-powered video editing runs on remote GPU nodes”
Recommendation

Only upload footage you are comfortable sending to the remote provider, and review the provider's privacy and retention practices if the content is sensitive.

What this means

Anyone with the token could potentially use the associated NemoVideo session or credits.

Why it was flagged

The skill uses a bearer token to authenticate all service calls; this is expected for the integration and the instructions say not to print tokens.

Skill content
“Every API call needs `Authorization: Bearer <NEMO_TOKEN>`”
Recommendation

Treat NEMO_TOKEN as a secret, avoid pasting it into shared logs, and prefer a dedicated token for this service.

What this means

Invoking the skill can create a remote session before any edit is completed.

Why it was flagged

The skill directs the agent to automatically initiate a remote API session when used; this is aligned with the cloud editing workflow but is still an external action.

Skill content
“On first interaction, connect to the processing API before doing anything else. Show a brief status like ‘Setting things up...’.”
Recommendation

Use the skill only when you intend to connect to NemoVideo, and ask for confirmation before uploads or exports if you want tighter control.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

A render job may keep running briefly even if the user closes the session.

Why it was flagged

Remote render jobs may continue outside the local chat/session after they are queued, although this is disclosed and bounded to the export workflow.

Skill content
“Each export job queues on a cloud GPU node ... closing the tab before completion orphans the job.”
Recommendation

Avoid starting exports accidentally, wait for completion when possible, and check whether the provider offers cancellation or job cleanup for sensitive projects.

What this means

Users have less information to verify who maintains the integration or the service it calls.

Why it was flagged

The registry metadata does not provide an external source or homepage, which limits provenance verification for a skill that connects to a remote media-processing API.

Skill content
“Source: unknown” and “Homepage: none”
Recommendation

Verify the provider and domain before using the skill with sensitive media.