Text To Video App
AdvisoryAudited by VirusTotal on Apr 16, 2026.
Overview
Type: OpenClaw Skill Name: text-to-video-app Version: 1.0.0 The skill bundle provides a legitimate integration for a text-to-video service hosted at mega-api-prod.nemovideo.ai. The SKILL.md file contains standard instructions for the AI agent to manage sessions, handle file uploads, and process video rendering tasks via a remote API. No indicators of data exfiltration, malicious execution, or harmful prompt injection were found; the behavior is entirely consistent with the stated purpose of the application.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may continue video editing or exporting steps through the provider API as part of the workflow.
The skill tells the agent to convert backend messages into API actions, including export. This fits the video-editing workflow, but export or edit actions can affect remote project state and credits.
"click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Use it for intended video tasks and ask the agent to confirm before exporting or spending credits if you want stricter control.
Your NemoVideo token or anonymous token may be used to create sessions, check credits, upload content, and export videos.
The skill requires and uses a service credential for NemoVideo sessions and exports. This is expected for the integration but gives the skill access to the associated account or anonymous credits.
If `NEMO_TOKEN` is in the environment, use it directly ... Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request
Use a dedicated token if possible, monitor credit usage, and revoke or rotate the token if you stop using the skill.
Text, documents, media, and generated drafts may be processed by the remote NemoVideo service.
The skill sends user prompts and uploaded files to an external provider for rendering. That is central to the service, but the files may contain private or sensitive content.
Upload TXT, DOCX, PDF, SRT files up to 200MB ... All calls go to `https://mega-api-prod.nemovideo.ai`
Only upload files you are comfortable sending to that provider, especially if they contain confidential business or personal data.