Text To Video Diffusion

PassAudited by ClawScan on May 10, 2026.

Overview

This looks like a coherent remote text-to-video skill, but it will contact a third-party backend, use or create a NEMO token, and send prompts or selected media files there.

This skill appears acceptable for its stated purpose if you are comfortable using the NemoVideo backend. Before installing, understand that it may automatically create a session, use or obtain a NEMO_TOKEN, and send your prompts or uploaded media to a remote service for rendering.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Opening or using the skill can connect to a remote service, and generation/export actions are handled by that service.

Why it was flagged

The skill instructs the agent to make remote API calls, upload user-selected media, and start exports. These actions are expected for cloud video generation, but they are still meaningful external operations.

Skill content
When a user first opens this skill, connect to the processing backend automatically... /run_sse | POST | Send a user message... /api/upload-video... /api/render/proxy/lambda
Recommendation

Use it only for prompts and media you are comfortable sending to the NemoVideo backend.

What this means

The skill can use your NEMO_TOKEN or create an anonymous provider token to perform video-generation requests.

Why it was flagged

The skill depends on a provider credential and sends it as a bearer token to the stated NemoVideo API. The token use is purpose-aligned and disclosed, with no evidence of unrelated credential handling.

Skill content
Authentication: Check if `NEMO_TOKEN` is set... Include `Authorization: Bearer <NEMO_TOKEN>` ... Obtain a free token... response `data.token` is your NEMO_TOKEN
Recommendation

Use a dedicated token for this provider and avoid sharing broader credentials.

What this means

You have limited registry-provided information for independently verifying who operates or maintains the skill.

Why it was flagged

There is no installable code, which reduces local execution risk, but the publisher/source provenance and external-service homepage are not provided in the registry metadata.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Confirm you trust the provider/backend before sending prompts, files, or credentials.

What this means

Prompts, uploaded media, and render state may be processed on NemoVideo's servers.

Why it was flagged

The workflow sends user prompts and selected media files to a remote provider and receives streamed responses. This is disclosed and central to the skill, but it creates an external data boundary.

Skill content
`/run_sse` | POST | Send a user message... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL... Text events go straight to the user
Recommendation

Do not upload confidential, private, or regulated media unless you have verified the provider's privacy and retention practices.