Maker Free Canva
AdvisoryAudited by Static analysis on May 5, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
When you invoke the skill, it may immediately contact the external service and later upload files or trigger rendering based on your request.
The skill directs the agent to perform provider API operations, including uploads and exports. This is aligned with the video-generation purpose, but it is still meaningful automation of external actions.
“On first interaction, connect to the processing API before doing anything else” and “Upload: POST `/api/upload-video/...` ... Export ... Poll GET ... until `status` = `completed`.”
Use it only for files you intend to process in the cloud, and review export/upload requests before relying on the result.
The skill can act within the privileges of the NemoVideo token, such as creating sessions and render jobs.
The skill uses a bearer token for the NemoVideo API and can obtain an anonymous token if one is not present. This is expected for the service integration, and the artifact says not to print tokens.
“If `NEMO_TOKEN` environment variable is already set, use it” and “The response field `data.token` becomes your NEMO_TOKEN” plus “Authorization: Bearer <NEMO_TOKEN>.”
Keep NEMO_TOKEN private, avoid sharing logs containing credentials, and use a limited or disposable token when possible.
Private images, video clips, audio, URLs, and prompt text you provide may be processed by NemoVideo’s cloud service.
The skill sends user media and prompts to an external provider for processing. The destination and purpose are disclosed, but the data leaves the local environment.
“This tool takes your images or clips and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.” and “API base: `https://mega-api-prod.nemovideo.ai`.”
Do not use highly sensitive or confidential media unless you trust the provider’s terms, retention, and privacy practices.
A user might mistakenly assume this is an official Canva integration or that Canva handles the files.
The branding references Canva, but the described service backend is NemoVideo. The artifact does disclose the API base, so this is a clarity note rather than evidence of malicious deception.
“displayName: ‘Maker Free Canva — Create Videos From Images Free’” and “without paying for Canva Pro” while later stating “API base: `https://mega-api-prod.nemovideo.ai`.”
Treat this as a NemoVideo-backed cloud rendering skill, not an official Canva service, unless the publisher provides evidence of affiliation.