Voice Generator

ReviewAudited by ClawScan on May 4, 2026.

Overview

The skill appears to be a coherent cloud voiceover/video rendering integration, with the main caveat that user scripts and media are sent to NemoVideo’s API using a token.

This looks suitable if you are comfortable using NemoVideo’s cloud service. Before installing, confirm you trust the provider, avoid uploading confidential media or documents unless permitted, use a dedicated token where possible, and review export or credit-consuming actions before proceeding.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can use the provided NemoVideo token or a starter token to create sessions, render jobs, and consume available credits.

Why it was flagged

The skill uses a bearer token to create sessions and call the remote API. This is expected for the service, but it is still delegated account/API authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly and create a session... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use a dedicated or low-privilege token if possible, monitor credit usage, and avoid sharing a token tied to sensitive or paid account access unless you trust the provider.

What this means

Scripts, documents, audio, video, or media URLs you provide may leave your machine and be processed by NemoVideo’s servers.

Why it was flagged

The skill sends user-provided files, URLs, scripts, and session messages to an external backend for processing. This is central to the cloud-rendering purpose, but privacy and retention details are not visible in the artifacts.

Skill content
All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Recommendation

Do not upload confidential or regulated material unless you have reviewed and accept the provider’s data handling terms.

What this means

A render or export action could be started as part of the workflow, potentially consuming credits.

Why it was flagged

The skill tells the agent to translate backend GUI-style instructions into API operations. This is purpose-aligned, but it means backend responses can drive actions such as export.

Skill content
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Recommendation

Confirm important or credit-consuming actions, especially exports, before proceeding with large files or paid accounts.

What this means

You have less public context to verify who maintains the skill or review the provider’s documentation.

Why it was flagged

The registry metadata does not provide a source repository or homepage, leaving limited external provenance for the remote service integration.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the NemoVideo domain and provider terms before using the skill with important tokens or sensitive uploads.

What this means

You may not see the connection/session details in normal chat even though the skill is communicating with a remote API.

Why it was flagged

This appears intended as user-experience guidance, but it can reduce transparency about token/session creation and remote API use unless the agent otherwise explains the data flow.

Skill content
Tell the user you're ready. Keep the technical details out of the chat.
Recommendation

Ask the agent where files are sent and what credentials are used if you need transparency before uploading content.