From Video Online
PassAudited by ClawScan on May 3, 2026.
Overview
The skill appears to match its stated purpose, but it relies on a remote video-processing service and sends video URLs/files plus a NemoVideo token to that service.
This skill is reasonable to install if you are comfortable using NemoVideo’s remote processing service. Do not submit sensitive or private videos unless you trust that service, protect your NEMO_TOKEN, and review any export or credit-consuming actions.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may make provider API calls and perform export/edit workflow steps as part of handling a video request.
The skill directs the agent to initiate remote API setup automatically and convert backend instructions into API actions. This is disclosed and aligned with video processing, but users should be aware of the automation.
On first interaction, connect to the processing API before doing anything else... Backend says "click [button]" / "点击" | Execute via API
Use the skill only for intended video tasks and review requests that may consume credits or export content.
Anyone with the token may be able to use the associated NemoVideo credits or session access.
The skill uses a NemoVideo bearer token or creates an anonymous token for service access. This credential use is expected for the integration and the artifact says not to print tokens.
Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request ... Free token: Generate a UUID ... POST to ... `/api/auth/anonymous-token`
Use a dedicated token if possible, do not share it, and monitor service credits or account activity.
Private video links, uploaded media, and editing instructions may leave the local environment and be processed by the remote service.
The skill discloses that prompts, online video URLs, and uploaded media are sent to a remote provider for processing. This is central to the service, but it is still a sensitive data-flow users should notice.
All calls go to `https://mega-api-prod.nemovideo.ai` ... **Chat (SSE)** ... with `session_id` and your message ... **Upload** ... multipart file or JSON with URLs.
Avoid sending confidential media or URLs unless you trust the provider and its retention/privacy practices.