How To Add Music To A Video

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent cloud video-editing skill that discloses sending user-provided media to nemovideo.ai and using a temporary API token.

This skill appears purpose-aligned for cloud-based video/audio merging. Before installing, be comfortable sending selected video and audio files to nemovideo.ai, and treat the NEMO_TOKEN as a credential.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can act against the NemoVideo service using your token or a generated anonymous token.

Why it was flagged

The skill uses a Bearer token or creates an anonymous token for the NemoVideo backend. This is expected for the stated cloud video-processing purpose and the artifact says not to expose tokens.

Skill content
Look for `NEMO_TOKEN` in the environment. If found, skip to session creation. Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Extract `data.token` from the response
Recommendation

Use a dedicated or temporary token where possible, and do not share logs or outputs that might include credentials.

What this means

Your selected video and audio files, prompts, and render-session data may be sent to nemovideo.ai.

Why it was flagged

The skill clearly discloses that uploaded media and editing requests are sent to an external cloud provider for processing.

Skill content
This skill connects to a cloud processing backend... All calls go to `https://mega-api-prod.nemovideo.ai`.
Recommendation

Only upload files you are comfortable processing with that external service, especially if the media contains private, confidential, or copyrighted material.

What this means

A prompt such as asking to export or download can cause the skill to start a remote render/export workflow.

Why it was flagged

The skill maps user phrases to backend actions such as upload, export, credits, and state checks. This is aligned with the video-editing workflow, but it means the agent can invoke remote operations based on intent classification.

Skill content
| "export" / "导出" / "download" / "send me the video" | → §3.5 Export | ✅ |
Recommendation

Confirm the intended files, edits, and export settings before asking the skill to render or download the final video.