Text To Video Brainrot

ReviewAudited by ClawScan on May 5, 2026.

Overview

This skill is coherent for cloud text-to-video generation, but it will use a NemoVideo token and send prompts or media to NemoVideo's cloud service.

Before installing, make sure you trust NemoVideo with the prompts and media you provide, protect your NEMO_TOKEN, and be aware that exports may consume provider credits.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill starts a connection to NemoVideo's service and may create a rendering session before a video is generated.

Why it was flagged

The skill automatically initiates a provider API session when used. This is disclosed and necessary for the cloud renderer, but users should know the skill makes outbound API calls immediately after invocation.

Skill content

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Recommendation

Install only if you are comfortable with automatic provider setup when invoking the skill; confirm export actions before spending credits.

Low

#ASI03: Identity and Privilege Abuse

What this means

The token may allow use of the associated NemoVideo credits or account permissions.

Why it was flagged

The skill uses a bearer token to authenticate to the NemoVideo API. This is expected for the service integration and the instructions tell the agent not to expose the token.

Skill content

All requests must include: `Authorization: Bearer <NEMO_TOKEN>` ... Don't print tokens or raw JSON.

Recommendation

Use a service-specific token, keep it private, and rotate it if you suspect it was exposed.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Scripts, prompts, images, audio, or videos provided to the skill may leave the local environment and be processed by NemoVideo.

Why it was flagged

The skill sends prompts, uploaded media, and rendering/session data to an external cloud provider. This is central to the stated purpose, but it creates a data-sharing boundary users should notice.

Skill content

Base URL: `https://mega-api-prod.nemovideo.ai` ... `/run_sse` ... `/api/upload-video/nemo_agent/me/<sid>` ... Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Recommendation

Do not submit private, confidential, or rights-sensitive media unless you trust the provider and its terms.