Text To Video Free Trial
AdvisoryAudited by VirusTotal on Apr 16, 2026.
Overview
Type: OpenClaw Skill Name: text-to-video-free-trial Version: 1.0.0 The skill is a functional integration for the NemoVideo text-to-video service. It provides detailed instructions for an AI agent to manage authentication, session handling, and video generation via the 'mega-api-prod.nemovideo.ai' API. The requested permissions, such as reading the NEMO_TOKEN environment variable and accessing local files for upload, are directly aligned with the stated purpose of generating videos from text. No evidence of data exfiltration, unauthorized execution, or malicious intent was found in SKILL.md or _meta.json.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Files, URLs, or prompt text you provide may be sent to NemoVideo's cloud API to generate videos.
The skill can upload user-selected files or URLs to the external video service. This is central to the text-to-video workflow, but it is still a sensitive operation users should notice.
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Only upload files you intend to process with this service, and avoid sending private or regulated documents unless you trust the provider.
Anyone who obtains the token may be able to use the associated NemoVideo API access or trial credits.
The skill relies on a bearer token for provider API access. Credential use is expected for this service and the artifact says not to print tokens, but the token remains account/API authority.
**Token**: If `NEMO_TOKEN` environment variable is already set, use it ... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated or disposable token where possible, keep it out of chat logs, and rotate it if it is exposed.
It may be harder to confirm whether this skill is officially associated with the NemoVideo service.
The skill is instruction-only, but the registry metadata does not provide a source repository or homepage to independently verify the publisher or service relationship.
Source: unknown; Homepage: none
Verify the publisher and API domain before using the skill for valuable or sensitive content.
Your project draft, generated media, and render job state may remain associated with the provider session.
The workflow maintains provider-side session state containing drafts, media information, and generated media. This is expected for video generation but means content may persist in cloud state.
**Session**: POST ... Save `session_id` ... **Session state**: GET `/api/state/nemo_agent/me/<sid>/latest` — key fields: `data.state.draft`, `data.state.video_infos`, `data.state.generated_media`
Treat the service as cloud storage/processing, avoid sensitive material unless appropriate, and clear or abandon sessions according to the provider's controls.