Online Text To

ReviewAudited by ClawScan on May 10, 2026.

Overview

This looks like a disclosed cloud text-to-video connector, but it sends your scripts or uploaded media to NemoVideo and uses a service token/session to render exports.

This skill appears purpose-aligned for converting text into videos. Before installing, be comfortable with sending your scripts and any uploaded files to NemoVideo, using a NemoVideo token/session, and potentially consuming service credits when exporting videos.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can use the NemoVideo token to create sessions, check credits, upload assets, and start exports for that service.

Why it was flagged

The skill uses a bearer token for the NemoVideo service. This is expected for the stated cloud rendering workflow, and the artifact does not show token logging or unrelated credential use.

Skill content
Check if `NEMO_TOKEN` is set... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use only a service-specific token, avoid sharing or committing it, and clear or rotate it if you stop trusting the skill or provider.

What this means

Private scripts, documents, images, audio, or video files you provide may be processed by NemoVideo’s cloud service.

Why it was flagged

The skill sends user prompts, scripts, and optionally uploaded media to an external cloud provider and receives streamed responses. This is central to the skill’s purpose but has privacy implications.

Skill content
Send me your text script... All rendering happens server-side... Base URL: `https://mega-api-prod.nemovideo.ai`... `/run_sse`... `/api/upload-video/nemo_agent/me/<sid>`
Recommendation

Only submit content you are comfortable sending to the NemoVideo backend, and review the provider’s privacy and retention terms before uploading sensitive material.

What this means

The remote service can guide the agent to perform session actions such as edits, state checks, uploads, or exports, potentially consuming service credits.

Why it was flagged

The skill allows provider-streamed workflow messages to be translated into API actions inside the video session. This appears purpose-aligned, but users should be aware that edits or exports may be driven through backend-directed API operations.

Skill content
Text events go straight to the user... Tool calls stay internal... Backend says "click [button]" / "点击" | Execute via API
Recommendation

Ask the agent to confirm before exporting, uploading large files, or taking actions that may use credits or publish/share output.

What this means

You are relying on an unknown-source skill definition and a third-party cloud API for processing.

Why it was flagged

The artifact does not include executable code or an install step, but provenance signals are limited, so users have less external context for trusting the publisher or backend service.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Prefer known publishers for sensitive workflows, and verify the NemoVideo service independently before sending private or business-critical content.