Ai Video Maker From Photos
PassAudited by ClawScan on May 8, 2026.
Overview
This skill is coherent with a cloud photo-to-video maker, but it uses a NemoVideo token and sends selected media to an external API.
This appears safe to use for its stated purpose if you are comfortable sending the selected photos or image URLs to NemoVideo's cloud API. Avoid uploading sensitive personal images unless you trust the provider, and prefer a dedicated or revocable NEMO_TOKEN.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Photos, images, and possibly URLs you provide may be uploaded to NemoVideo's cloud service for processing.
The skill sends user-provided media files or URLs to an external backend for rendering. This is purpose-aligned, but it means private photos or source URLs leave the local environment.
**API base**: `https://mega-api-prod.nemovideo.ai` ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Only provide media you are comfortable uploading to this third-party service, and check the provider's privacy/retention practices if the images are sensitive.
The skill can act within the NemoVideo session associated with the token and may affect service credits or generated media for that account/session.
The skill uses a service bearer token or obtains an anonymous starter token to create sessions and make API calls. This is expected for the backend integration, but it is still account/session authority.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... Otherwise, acquire a free starter token
Use a dedicated or revocable token where possible, and monitor credits or account activity if using a personal NemoVideo token.
The backend can steer actions within the video workflow, such as querying state or starting export, without showing every low-level step to the user.
The skill instructs the agent to translate backend GUI-style messages into API actions. This is part of the intended workflow, but it gives remote backend responses influence over subsequent actions.
Backend says ... `click [button]` ... `Execute via API` ... `Export button` ... `Execute export workflow`
Keep actions limited to the video-making APIs and ask for user confirmation before uploading additional files, exporting, or performing any out-of-scope action.
You have less independent information about who maintains the skill or the service integration.
The registry does not provide a source repository or homepage for the skill. There is no code install here, but provenance is limited for a skill that integrates with an external media-processing service.
Source: unknown; Homepage: none
Verify that `mega-api-prod.nemovideo.ai` is the intended provider before uploading sensitive media.