Slideshow Maker
PassAudited by ClawScan on May 3, 2026.
Overview
The skill appears purpose-aligned for creating cloud-rendered slideshow videos, but users should know it uses a NemoVideo token and sends selected media to an external backend.
Install this only if you are comfortable using NemoVideo's cloud service for the selected photos, videos, audio, and prompts. Use a limited-purpose NEMO_TOKEN, watch account credits, and avoid uploading private or sensitive media unless you trust the provider's handling of it.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can use a NemoVideo token to create sessions, upload media, check credits, and export videos, which may affect account credits or expose account-linked activity to the backend service.
The skill declares use of a NemoVideo token and a local NemoVideo config path. This is consistent with a cloud service integration, but it is still account/profile authority that users should notice.
requires": {"env": ["NEMO_TOKEN"], "configPaths": ["~/.config/nemovideo/"]}, "primaryEnv": "NEMO_TOKEN"Use a token intended for this service, avoid granting broader account access than needed, and review whether access to ~/.config/nemovideo/ is acceptable.
Any media provided to the skill may be uploaded to NemoVideo's cloud service for rendering, where privacy, retention, and access controls depend on that service.
The skill clearly discloses that user media is processed by an external cloud API. This is expected for the stated purpose, but personal photos, videos, audio, and prompts may leave the user's device.
This tool takes your images or clips and runs AI slideshow creation through a cloud rendering pipeline... All calls go to `https://mega-api-prod.nemovideo.ai`.
Only upload media you are comfortable sending to the NemoVideo backend, and review the provider's privacy and retention practices if the content is sensitive.
Users may not be reminded in-chat that the skill is connecting to an external service and using or creating a token before processing requests.
The instruction appears intended to simplify the user experience, but it could reduce visibility into automatic backend connection and token/session setup.
Tell the user you're ready. Keep the technical details out of the chat.
The skill should remain transparent when it is about to upload media or create/use an external service token, especially for sensitive content.