Editor To Generator

PassAudited by VirusTotal on May 4, 2026.

Overview

Type: OpenClaw Skill Name: editor-to-generator Version: 1.0.0 The 'editor-to-generator' skill (SKILL.md, _meta.json) is a functional tool designed to interface with the nemovideo.ai API for AI-driven video generation. It includes logic for anonymous authentication, session handling, and file uploads to https://mega-api-prod.nemovideo.ai. The instructions are well-defined and align with the stated purpose of converting video clips via a cloud pipeline, with no evidence of data exfiltration, malicious execution, or harmful prompt injection.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill can automatically create a Nemo Video backend session and prepare remote processing.

Why it was flagged

The skill tells the agent to initiate remote setup automatically. This is coherent for a cloud video backend, but it means the agent may contact the service before a separate confirmation step.

Skill content
On first use, set up the connection automatically and let the user know ("Connecting...").
Recommendation

Use the skill only when you intend to connect to the Nemo Video service, and ask the agent to confirm before uploads or exports if you want tighter control.

What this means

The skill can use the configured or generated Nemo Video token and associated credits for video operations.

Why it was flagged

The skill uses a bearer token for all backend calls and can create an anonymous token if one is not present. This credential use is disclosed and expected for the service.

Skill content
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Extract `data.token`
Recommendation

Keep NEMO_TOKEN private, monitor credit usage, and revoke or rotate the token if you no longer trust the skill or backend.

What this means

Private videos, images, audio, and editing instructions may leave the local environment for cloud processing.

Why it was flagged

The core workflow sends user media and prompts to an external cloud backend. This is central to the skill and clearly disclosed, but it is still a sensitive data flow.

Skill content
This tool takes your existing video clips and runs AI video generation through a cloud rendering pipeline. You upload, describe what you want, and download the result.
Recommendation

Avoid uploading confidential, regulated, or third-party-restricted media unless you have reviewed the provider’s privacy, retention, and usage terms.

What this means

Users have limited provenance information for assessing the operator of the cloud service before sending media.

Why it was flagged

The artifacts do not provide a public source or homepage to independently verify the skill publisher or remote backend beyond the registry metadata.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the publisher and Nemo Video service through trusted channels before using the skill with sensitive projects.