v1.0.0

With Music

BenignClawScan verdict for this skill. Analyzed Apr 30, 2026, 10:30 PM.

Analysis

This skill is a cloud video-music editor that appears coherent, but users should expect their media to be uploaded to NemoVideo and processed through remote API sessions.

GuidanceBefore installing, confirm that you are comfortable uploading your videos, audio, images, and prompts to NemoVideo's cloud service and letting the backend drive editing/export actions within that session. No malicious behavior or local code execution was evident in the provided artifacts.

Findings (8)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityLowConfidenceHighStatusNote

SKILL.md

"Backend says" ... "click [button]" ... "Execute via API" ... "Export button" ... "Execute export workflow"

Backend text is treated as operational instruction for API actions, so the remote service can influence the agent's workflow inside the editing session.

User impactThe remote editing backend can guide what actions the agent takes in the video session, including export-related steps.

RecommendationUse this only when you are comfortable letting the NemoVideo backend control the editing workflow for the files you provide.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

"/api/upload-video/nemo_agent/me/<sid>" ... "Upload a file"; "/api/render/proxy/lambda" ... "Start export"

The skill exposes upload, state, SSE, credit, and render API operations. These are aligned with video editing but can mutate a cloud session and consume service resources.

User impactFiles you provide may be uploaded and cloud render jobs may be started as part of normal use.

RecommendationReview the requested action before asking the skill to upload or export, especially if credits or private media are involved.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceMediumStatusNote

metadata

Source: unknown; Homepage: none

The registry metadata provides limited provenance for the skill publisher/source, although no install scripts or code dependencies are present.

User impactYou have limited external information to verify who maintains the skill or the associated service integration.

RecommendationInstall only if you trust the publisher and are comfortable using the disclosed NemoVideo cloud endpoint.

Cascading Failures

SeverityInfoConfidenceHighStatusNote

SKILL.md

The session token carries render job IDs, so closing the tab before completion orphans the job.

Cloud render jobs can outlive the active interaction if the session is interrupted, which may leave work in progress without local control.

User impactA render may continue or become hard to track if the session is closed before completion.

RecommendationKeep the session open until exports finish and verify job status before starting another render.

Human-Agent Trust Exploitation

SeverityInfoConfidenceHighStatusNote

SKILL.md

On first use, set up the connection automatically and let the user know ("Connecting...").

The skill performs automatic token/session setup with brief user-facing messaging. This is aligned with onboarding, but users should notice that a remote account/session is being created.

User impactYou may see a simple connection message while the skill creates or uses a NemoVideo session in the background.

RecommendationMake sure you are comfortable with automatic cloud connection setup before using the skill.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityInfoConfidenceHighStatusNote

SKILL.md

"Token check": Look for `NEMO_TOKEN` ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Extract `data.token`

The skill requires or obtains a NemoVideo bearer token. This is expected for the service and no artifact shows hardcoded, leaked, or unrelated credentials.

User impactThe skill will authenticate to NemoVideo on your behalf, either with your NEMO_TOKEN or an anonymous token.

RecommendationUse a token intended for this service and avoid sharing it outside the skill.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

SKILL.md

Keep the returned `session_id` for all operations; `/api/state/nemo_agent/me/<sid>/latest` ... Fetch current timeline state

The workflow relies on remote session state and timeline state, which can persist context about the user's media and edits during the task.

User impactYour editing session, timeline, generated media references, and render state may be stored and reused by the cloud service during the workflow.

RecommendationAvoid uploading sensitive media unless you are comfortable with remote session-based processing.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

`/run_sse` ... "Send a user message" ... "Stream response"; "Tool call/result" ... "Process internally, don't forward"

The skill communicates with a remote agent-like backend over SSE and processes tool-call events internally. The endpoint is disclosed and purpose-aligned, but this is still a sensitive provider communication path.

User impactYour prompts and task context are sent to a remote backend that can return structured events used by the agent.

RecommendationDo not send confidential prompts or media unless the NemoVideo service is acceptable for that content.