Text And Video

ReviewAudited by ClawScan on Apr 30, 2026.

Overview

This instruction-only skill appears aligned with cloud text-to-video creation, but it sends user text and media to a NemoVideo backend using a token-based session.

Before installing, make sure you are comfortable sending your text, documents, videos, and generated media to NemoVideo's cloud service. Use a dedicated NEMO_TOKEN if possible, avoid confidential uploads, and confirm any credit, registration, or export-plan limits.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A remote service response may cause the agent to make additional video-service API calls within the session.

Why it was flagged

The external backend can influence the agent's next API actions by returning GUI-like instructions. This is purpose-aligned for the service, but users should know backend responses steer the workflow.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: - "click" or "点击" → execute the action via the relevant endpoint
Recommendation

Keep use limited to the intended NemoVideo workflow and review important actions like upload and export before proceeding.

What this means

Files or URLs supplied for video creation will be sent to the NemoVideo cloud backend.

Why it was flagged

The skill instructs the agent to upload local files or URLs to a remote video service. This is expected for text/video generation, but it is a sensitive tool operation.

Skill content
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only provide files and URLs you intend to upload to this third-party service.

What this means

Video jobs and uploads are tied to the NemoVideo token or anonymous identity used by the skill.

Why it was flagged

The skill uses a NemoVideo bearer token or creates an anonymous token for service access. The credential requirement is disclosed and aligned with the cloud backend.

Skill content
Token check: Look for `NEMO_TOKEN` in the environment. If found, skip to session creation. Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`
Recommendation

Use a dedicated token if possible and avoid sharing or exposing the token outside this workflow.

What this means

Users have less publisher and service provenance information to review before trusting the cloud workflow.

Why it was flagged

The skill has no known source or homepage in the provided metadata, while it depends on an external cloud API. This is a provenance gap, not direct evidence of malicious behavior.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider and service terms before sending important or sensitive content.

What this means

Your text, uploaded media, drafts, and generated outputs may be stored or processed in the remote NemoVideo session.

Why it was flagged

User prompts and media are processed remotely, and the skill also queries session state containing drafts and generated media. This is expected for the service but involves sensitive content handling.

Skill content
Send me your text and video and describe the result you want. The text-to-video creation runs on remote GPU nodes
Recommendation

Do not upload private, confidential, or regulated content unless you are comfortable with NemoVideo processing it.

What this means

Your instructions are sent to a remote agent-like backend that may generate responses and drive the video workflow.

Why it was flagged

The skill communicates with a remote `nemo_agent` over SSE using a bearer-authenticated session. This is disclosed and purpose-aligned, but it is a third-party agent/provider boundary.

Skill content
Send message (SSE): POST `/run_sse` — body `{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}`
Recommendation

Treat the backend as an external service and avoid sending content you would not share with that provider.

What this means

A started render may continue remotely even if you leave before it finishes.

Why it was flagged

Remote render jobs can continue or become orphaned if the client session ends before completion. This is disclosed and consistent with cloud rendering, but it affects job containment.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Start exports only when you intend to wait for completion, and check job status if you reconnect.

What this means

You may need registration or an upgraded plan to export even if credits are available.

Why it was flagged

The export language may be confusing because it says export is free/no credits while also documenting a plan-based export block. The tradeoff is disclosed, but users should notice it.

Skill content
**Export** (free, no credits) ... 402 | Free plan export blocked | Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
Recommendation

Confirm pricing, credit, and export limits before relying on the skill for finished videos.