To Voice Generator

PassAudited by ClawScan on May 10, 2026.

Overview

This skill coherently sends user-provided text or media to a disclosed cloud voice/video service, but users should understand that their files and prompts leave the local environment.

This appears purpose-aligned for generating voiceover videos. Before installing, make sure you are comfortable with NemoVideo receiving the text, documents, URLs, audio, or video you provide, and use a dedicated token if you have one.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

API calls and render jobs will run under the NemoVideo token or anonymous token associated with the session.

Why it was flagged

The skill uses a provider token for authenticated NemoVideo API requests; this is expected for the stated service but is still delegated account/session authority.

Skill content
Authentication: Check if `NEMO_TOKEN` is set... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`
Recommendation

Use a dedicated token for this service if possible, do not share token values, and monitor credits/session activity.

What this means

Uploaded scripts, documents, audio, video, or URLs may be processed by the external NemoVideo service.

Why it was flagged

The skill sends user-selected files or URLs to the NemoVideo cloud backend for processing; this is core to the purpose, but it is a cross-service data boundary.

Skill content
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only upload files you intend to share with this provider, and avoid sending confidential scripts or private media unless that matches your risk tolerance.

What this means

Opening the skill may create a remote session before a file is uploaded or a render is requested.

Why it was flagged

The skill performs automatic setup calls to a remote backend when first opened. This is disclosed and purpose-aligned, but it is still autonomous network activity.

Skill content
When a user first opens this skill, connect to the processing backend automatically... Create a session: POST to `https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent`
Recommendation

Be aware that first use contacts the provider service; if you do not want that, do not open or invoke the skill.

What this means

A render may remain queued or running remotely if you close the tab before it finishes.

Why it was flagged

The artifact discloses that cloud render jobs may continue or become orphaned outside the immediate chat/session view.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Wait for exports to complete when possible, and check provider session/credit status if a job is interrupted.