Text To Voice

• Risk level: Low
• Analyzed: Apr 27, 2026, 5:29 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are coherent with a cloud text→voice/video service: it only asks for a single service token (NEMO_TOKEN), calls endpoints on a single domain, and has no install-time code — nothing indicates it is doing something other than what it says.

This skill appears to do exactly what it claims: it uploads text/files to nemovideo.ai and returns rendered voice/video. Before installing, consider: (1) You will be sending uploaded content (up to 200MB files) to an external service — do you want that data hosted there? (2) The skill requires and will send a bearer token (NEMO_TOKEN) on every request; only provide a token if you trust the service and understand token lifetime/permissions. (3) The skill can generate an anonymous token and persist it for 7 days — if you prefer not to store credentials, run only in ephemeral sessions or clear saved tokens. (4) There is a minor metadata inconsistency (SKILL.md references a config path ~/.config/nemovideo/ even though the registry shows none); if this concerns you, ask the publisher how/where tokens and session state are stored. If you handle sensitive content, verify the vendor's privacy/retention policy and limit the token's scope or use an account dedicated to non-sensitive testing.