Add Music To Video Canva

• Risk level: Low
• Analyzed: Apr 29, 2026, 4:10 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are consistent with a connector that uploads videos to an external NemoVideo rendering service and therefore its requested env var (NEMO_TOKEN) and API calls make sense — but you should be aware it will send your video data and use tokens/credits on that external service.

This skill appears to be a straightforward connector to an external rendering service (mega-api-prod.nemovideo.ai). Before installing or using it: - Understand that your video/audio files will be uploaded to that external service for processing. Do not use it for sensitive/private videos unless you trust that service and have reviewed its privacy/terms. - If you supply your own NEMO_TOKEN, the skill will act as your account and may consume credits; prefer the anonymous-token flow if you only want to try it. Anonymous tokens are short-lived (7 days) and grant limited free credits according to the SKILL.md. - The SKILL.md asks the agent to detect an install path (e.g., ~/.clawhub, ~/.cursor) and references ~/.config/nemovideo/ — this implies the agent may read certain paths in your home directory for attribution. If you are uncomfortable with that, ask the skill author to remove or explain that behavior. - Note the registry vs SKILL.md minor mismatch about the config path; consider asking the publisher (or avoid granting a permanent account token) until clarified. Overall the pieces are coherent for the stated purpose, but treat the external upload and token usage as the primary privacy/operational risk.