Create Video With Ai Free

Security checks across malware telemetry and agentic risk

Overview

This is a coherent cloud video-generation skill, but it sends selected media and prompts to a third-party NemoVideo API using a provider token.

Install only if you are comfortable using a NemoVideo token or anonymous provider token and sending selected media files, prompts, and related job data to https://mega-api-prod.nemovideo.ai for cloud rendering.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI03: Identity and Privilege Abuse
Low
What this means

The skill may use your configured NemoVideo token or create an anonymous token for the service.

Why it was flagged

The skill uses a provider token or obtains an anonymous provider token to authorize cloud video requests. This is expected for the service, but it affects provider account/session usage and credits.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly... Otherwise, acquire a free starter token... use it as NEMO_TOKEN
Recommendation

Only provide or allow use of NEMO_TOKEN if you trust the provider and understand how credits, sessions, and token expiry work.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Images, clips, audio, URLs, and prompt text you provide for video generation may be uploaded to NemoVideo's servers.

Why it was flagged

The skill sends user media and prompts to a third-party cloud API for rendering. This is disclosed and aligned with the advertised cloud video-generation purpose.

Skill content
All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Recommendation

Avoid uploading private or sensitive media unless you are comfortable with that provider processing it.

#
ASI10: Rogue Agents
Info
What this means

A cloud render job may continue running briefly even if you stop interacting with the skill.

Why it was flagged

Provider-side render jobs may continue after the local interaction is closed. The behavior is disclosed and limited to the requested video-rendering workflow.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Check job status or provider credits if you cancel or close a session during rendering.