Blog To Video Converter

• Verdict: Pass
• Confidence: Medium
• Analyzed: May 6, 2026, 10:26 AM
• Findings: 2
• Version: 1.0.0

Overview

The skill appears to be a coherent cloud blog-to-video converter, but it sends user-provided content to Nemovideo's API and uses a Nemo token/session.

This skill looks purpose-aligned and does not include local code or suspicious install steps. Before installing, decide whether you trust Nemovideo's cloud service with the blog content or documents you provide, use a dedicated NEMO_TOKEN if available, and avoid sending confidential drafts unless the provider's privacy and retention practices meet your needs.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

The skill can act within the Nemo video service using the provided or generated token, including creating sessions and render jobs that may consume credits.

Why it was flagged

The skill uses a service token, and can create an anonymous token, to authenticate all cloud rendering requests.

Skill content

Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... If found, skip to session creation. Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`

Recommendation

Use a dedicated or low-risk token when possible, avoid sharing the token, and monitor credit usage or revoke the token if it is no longer needed.

ASI07: Insecure Inter-Agent Communication

NoteHigh Confidence

What this means

Private drafts, PDFs, DOCX files, or URLs may leave the local environment and be processed by Nemovideo's cloud service.

Why it was flagged

User-provided blog content, files, URLs, draft state, and render requests are sent to an external cloud provider; the artifact does not describe retention or privacy terms.

Skill content

This skill connects to a cloud processing backend ... All calls go to `https://mega-api-prod.nemovideo.ai` ... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.

Recommendation

Only upload content you are authorized and comfortable sending to the external provider, and review the provider's privacy and retention practices before using confidential material.