Voiceai Voiceover

• Risk level: Low
• Analyzed: Apr 28, 2026, 12:46 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requests and runtime instructions are consistent with a remote voiceover service: it needs a service token and will upload/process media on the vendor's API; there is no hidden install or unrelated credential access.

This skill behaves like a thin client for a third‑party voiceover service: it will upload any media you give it and use a NEMO_TOKEN (or obtain a short-lived anonymous token) to call https://mega-api-prod.nemovideo.ai. There is no code installed locally. Before installing, confirm you trust the nemovideo domain and its privacy/billing practices (you may be charged or your content processed by their servers), and be comfortable with the agent sending files and session metadata there. Note the skill reads its own frontmatter and may check its install path to set attribution headers — this is reasonable but means the agent will inspect its environment. If you prefer, do not set an account token and instead review the anonymous-token flow and any registration/upgrading flows described in the skill. Finally, the registry metadata showed no required config paths while the SKILL.md metadata references ~/.config/nemovideo/ — a minor inconsistency to be aware of but not indicative of malicious behavior.