Xiaohongshu Video

• Risk level: Low
• Analyzed: Apr 18, 2026, 5:16 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's requirements and runtime instructions are internally coherent for a cloud video-creation service, but it will upload your media and create/hold service tokens on your behalf — review the remote service and privacy implications before using.

This skill sends your uploaded media and session tokens to mega-api-prod.nemovideo.ai and will create a short-lived anonymous token if you don't provide one. Before installing or using: 1) Confirm you trust the nemo/nemovideo service and its privacy policy; 2) Avoid uploading sensitive or private media (test with non-sensitive files first); 3) If concerned, supply your own NEMO_TOKEN so you control the credential lifecycle and revoke it when done; 4) Be aware the skill may write session state under ~/.config/nemovideo/ — delete that folder or revoke tokens when finished; 5) Monitor network activity and token values if you have security tooling. I rate the skill coherent for its purpose but the primary risk is data/credential sharing with an external service, not local code execution.