Karaoke Video Generator Free
PassAudited by ClawScan on May 10, 2026.
Overview
The skill is coherent for cloud karaoke-video rendering, but it uses a NemoVideo token and uploads user-selected media to an external API.
This skill looks purpose-aligned, but install it only if you are comfortable sending selected media files and a NemoVideo token to mega-api-prod.nemovideo.ai. Avoid private or confidential songs/media, monitor any credit usage, and verify the provider if provenance matters to you.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may contact the NemoVideo API and start the rendering workflow when the skill is used.
The skill directs the agent to perform network API setup, uploads, and export/polling actions. These actions are central to the stated cloud karaoke-rendering purpose and are disclosed.
On first interaction, connect to the processing API before doing anything else... Upload — POST /api/upload-video/... Export — POST /api/render/proxy/lambda
Use the skill when you intend to use the cloud service, and review export or upload requests if the media or credits are sensitive.
A NemoVideo credential or anonymous token will authorize API activity such as uploads, credit checks, and exports.
The skill uses a bearer token for the stated NemoVideo API. The artifact also says not to print tokens or raw JSON, and there is no evidence of sending the token to unrelated destinations.
If `NEMO_TOKEN` environment variable is already set, use it... Include `Authorization: Bearer <NEMO_TOKEN>`... on every request
Use a dedicated token if possible, avoid sharing the token in chat, and revoke or rotate it if you no longer trust the skill or provider.
Uploaded audio, video, images, or URLs may be processed by NemoVideo's cloud service.
The skill sends user-selected media or media URLs to an external provider API. This is expected for cloud rendering, but it is a data boundary users should understand.
All calls go to `https://mega-api-prod.nemovideo.ai`... Upload — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Do not upload private, confidential, or rights-sensitive media unless you are comfortable with that provider processing it.
Users have less provenance information for deciding whether to trust the skill and its external API endpoint.
The registry metadata does not provide a source repository or homepage, which limits independent verification of the skill owner/provider relationship.
Source: unknown; Homepage: none
Prefer installing only if you trust the publisher and the nemovideo.ai service, and verify the provider separately if this will handle sensitive media.