Character Generator
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may create or use a NemoVideo token and spend available service credits when generating or exporting media.
The skill uses or obtains a bearer token for the NemoVideo backend. This credential use is expected for the cloud-rendering integration, but users should understand that account/credit-bearing authorization is involved.
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request
Use a dedicated or low-privilege token if possible, and confirm before export or other credit-consuming actions.
Any prompts, files, image/audio/video inputs, or URLs you provide for generation may be transmitted to the NemoVideo backend.
The skill sends user prompts and uploaded media to an external provider API. This is central to the stated purpose, but it is still a sensitive data boundary.
All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Avoid uploading private or confidential media unless you trust the provider and its data handling terms.
The backend may cause the agent to perform additional generation, edit, state, or export API steps as part of the workflow.
The skill instructs the agent to translate backend GUI-style responses into API actions. This is part of the integration design, but it means remote service responses can drive follow-on API calls.
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
Ask the agent to confirm before exports, uploads, or actions that may consume credits or publish/share output.
It may be harder to independently verify who operates the backend service or review its privacy/security terms.
The skill has limited provenance information. There is no local code install shown, but users cannot verify the provider or project homepage from the supplied metadata.
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Verify the NemoVideo service and terms before sending sensitive prompts or media.