Free Text Online

PassAudited by VirusTotal on May 10, 2026.

Overview

Type: OpenClaw Skill Name: free-text-online Version: 1.0.0 The skill bundle is a functional integration for the NemoVideo AI video generation service (nemovideo.ai). It provides detailed instructions for the agent to manage authentication via environment variables or an anonymous token flow, handle session state, and interact with a cloud rendering pipeline. While it includes logic for attribution headers based on the installation environment (e.g., ~/.cursor/skills/), all network activity is directed to the legitimate service domain (mega-api-prod.nemovideo.ai) and aligns with the stated purpose of text-to-video conversion.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can act against the Nemo service using the provided or generated token and may consume available service credits during generation.

Why it was flagged

The skill uses a service credential or creates an anonymous token to access the Nemo backend. This is expected for the stated cloud rendering purpose, but it is still account/credit-bearing authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly ... Otherwise, acquire a free starter token ... The response includes a `token` with 100 free credits valid for 7 days
Recommendation

Use a dedicated token where possible, avoid sharing the token, and monitor credits or account usage.

What this means

Text, files, URLs, and generated project state may be processed by Nemovideo's cloud systems.

Why it was flagged

The skill sends prompts and uploaded media to an external provider over API/SSE. This is core to the service, but users should understand the data leaves their local environment.

Skill content
API base: `https://mega-api-prod.nemovideo.ai` ... Send message (SSE): POST `/run_sse` ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>`
Recommendation

Do not submit confidential text or private files unless you are comfortable with that provider processing them.

What this means

A request such as generating, editing, exporting, or following a backend instruction can trigger additional API calls without a separate technical prompt.

Why it was flagged

The skill instructs the agent to translate user intent and backend GUI-style responses into API operations. This is purpose-aligned, but it means the agent may make follow-up service calls automatically within the workflow.

Skill content
Everything else (generate, edit, add BGM…) | → §3.1 SSE ... `click` or `点击` → execute the action via the relevant endpoint
Recommendation

Confirm before uploading private files, exporting, or performing actions that could consume credits or change the project state.