Instagram Editor
ReviewAudited by ClawScan on May 10, 2026.
Overview
This skill appears to be a disclosed cloud video-editing integration, but users should know it sends media, prompts, and an auth token to the NemoVideo API.
This looks like a normal cloud video-editing skill rather than a malicious one. Before installing, be comfortable with NemoVideo receiving your uploaded media and edit prompts, and protect the NEMO_TOKEN like any other service credential.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may create a provider session before any editing is performed.
The skill directs the agent to make an external API connection automatically at first use. This is disclosed and aligned with the cloud editing purpose, but users should understand that first use contacts the provider.
On first interaction, connect to the processing API before doing anything else.
Use it only if you are comfortable with the skill contacting the NemoVideo API when invoked.
The provider token authorizes cloud editing requests and should be treated like a credential.
The skill uses a bearer token for the NemoVideo service. This is expected for the stated integration, and the artifact also instructs not to print tokens or raw JSON.
All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Keep NEMO_TOKEN private, avoid sharing logs that may contain headers, and revoke or rotate the token if it is exposed.
Your uploaded media and edit instructions may be processed by the external NemoVideo service.
The skill sends user-selected media to an external cloud rendering API. That is central to the skill's purpose and is disclosed, but videos, images, and audio may contain personal or sensitive content.
`/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Do not upload private or sensitive media unless you trust the provider and its retention/privacy practices.
A render job may remain active or become difficult to track if the session is interrupted.
The cloud render workflow can continue or remain queued outside the immediate chat session. This is normal for cloud rendering, but it indicates remote job state exists beyond a single prompt.
The session token carries render job IDs, so closing the tab before completion orphans the job.
Wait for render completion when possible and avoid starting jobs with sensitive media unless you are comfortable with cloud processing.