Photo Montage Maker

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Opening or invoking the skill may contact the NemoVideo backend and create a processing session.

Why it was flagged

The skill will initiate external API setup automatically when opened. This is disclosed and purpose-aligned, but users should be aware it makes network calls before rendering begins.

Skill content
When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").
Recommendation

Only use the skill if you are comfortable with automatic session setup against the listed NemoVideo API.

What this means

The skill can use the configured or generated NemoVideo token and associated credits for montage processing and export.

Why it was flagged

The skill uses a bearer token for every backend request. This is expected for the service, but it is still delegated account or credit authority.

Skill content
Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request
Recommendation

Treat NEMO_TOKEN like a credential, avoid sharing it, and monitor usage or credits if you use a non-anonymous account token.

What this means

Photos, videos, audio, and prompt text provided to the skill may be processed by NemoVideo outside your local environment.

Why it was flagged

User media and prompts are sent to an external cloud provider for processing. The data flow is disclosed and central to the purpose, but retention and privacy terms are not described in the artifact.

Skill content
This tool takes your photos and images and runs AI montage creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.
Recommendation

Avoid uploading sensitive personal media unless you trust the provider and have reviewed its privacy and retention practices.