Free Text No

PassAudited by ClawScan on May 12, 2026.

Overview

This skill is a coherent cloud video-generation integration, but users should know their prompts, optional media uploads, and Nemo API token are sent to a third-party backend.

Install only if you are comfortable sending video prompts and any selected media to Nemo's cloud service. Use a limited-purpose token, watch credit usage, and ask the agent to confirm before exporting if the request is ambiguous.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can use your Nemo token or an anonymous token to create sessions, check credits, generate videos, and export renders.

Why it was flagged

The skill uses a bearer token to access the Nemo backend, which is expected for a cloud video service but gives the agent delegated access to that service and its credits.

Skill content

All requests must include: `Authorization: Bearer <NEMO_TOKEN>`

Recommendation

Use a dedicated or anonymous token where possible, avoid sharing tokens in chat, and monitor credit usage.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Text prompts and any files you choose to upload may leave your local environment and be processed by Nemo's cloud service.

Why it was flagged

The artifact clearly discloses that prompts, session data, optional uploads, and export requests are handled by a third-party cloud provider.

Skill content

All calls go to `https://mega-api-prod.nemovideo.ai`. The main endpoints: ... **Chat (SSE)** ... **Upload** ... **Export**

Recommendation

Do not use sensitive, confidential, or regulated content unless you trust the provider and its data handling terms.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If the workflow is ambiguous, the agent might proceed with render/export steps based on backend responses rather than asking again.

Why it was flagged

The skill instructs the agent to convert backend GUI-style responses into API actions. This is part of the intended workflow, but export actions can consume credits or create downloadable outputs.

Skill content

Backend says ... "Export button" / "导出" | Execute export workflow

Recommendation

Confirm export or credit-consuming actions when the user's intent is not explicit.