Video Ecommerce
PassAudited by ClawScan on May 11, 2026.
Overview
This appears to be a normal remote video-editing integration, but it sends selected media and a NemoVideo token to the provider’s API.
This skill looks coherent for creating shoppable videos. Before using it, confirm you trust NemoVideo with the media you upload, protect your NEMO_TOKEN, and be aware that remote rendering jobs may keep running if interrupted.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using the skill should treat NEMO_TOKEN like an account credential because it may allow use of credits or access to video sessions on the provider service.
The skill uses a bearer token to access NemoVideo sessions, credits, uploads, and exports. This is expected for the integration and no unrelated token use is shown.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a scoped or dedicated NemoVideo token if available, do not share it, and revoke or rotate it if you no longer use the skill.
Uploaded videos, images, and audio may leave the local machine and be processed on NemoVideo’s servers.
The skill sends user-selected media to a remote provider API for processing. This is central to the stated video rendering purpose and the destination is disclosed.
Base URL: `https://mega-api-prod.nemovideo.ai` ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Only upload files you are comfortable sending to the provider, and review the provider’s privacy and retention terms for sensitive product footage.
A render may continue remotely after you stop watching it, potentially consuming credits or leaving an unfinished job on the provider side.
The artifacts disclose that remote render jobs can continue or become orphaned if the local session is interrupted. This is server-side job persistence, not evidence of hidden local background behavior.
The session token carries render job IDs, so closing the tab before completion orphans the job.
Monitor long-running exports and cancel or clean up jobs through the provider if the workflow supports it.