Qwen Video Generation Is Free

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent cloud video-generation skill, but it will contact NemoVideo, use or create a bearer token, and send user-selected prompts or media to that backend.

Install only if you are comfortable using an unknown-source, instruction-only cloud video skill that talks to mega-api-prod.nemovideo.ai. Avoid uploading sensitive media, keep NEMO_TOKEN private, and review any upload or export request before letting the agent proceed.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Users cannot easily verify who operates or maintains the skill before sending prompts or media to the cloud service.

Why it was flagged

The skill has no executable install path to review, but its origin and service homepage are not provided, limiting provenance verification.

Skill content
Source: unknown
Homepage: none
No install spec — this is an instruction-only skill.
Recommendation

Only use it with non-sensitive media unless you are comfortable with the unknown-source skill and the disclosed NemoVideo backend.

What this means

Opening or using the skill may start network setup and subsequent cloud API actions without each low-level request being shown.

Why it was flagged

The skill directs the agent to initiate backend setup automatically and to translate provider responses into further API calls. This is aligned with the video-rendering workflow, but users should notice the automation.

Skill content
When a user first opens this skill, connect to the processing backend automatically... The backend responds as if there's a visual interface. Map its instructions to API calls
Recommendation

Use the skill only when you intend to interact with the cloud renderer, and review requested uploads or exports before proceeding.

What this means

The agent will hold and use a service token that can create sessions, send prompts, upload media, check credits, and render outputs on that backend.

Why it was flagged

The skill uses a bearer token for the NemoVideo API and can obtain an anonymous token if one is not already set. This is expected for the service integration and no leakage is shown.

Skill content
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`... Obtain a free token... response `data.token` is your NEMO_TOKEN
Recommendation

Treat NEMO_TOKEN like a credential, do not share it, and rotate or remove it if you stop using the skill.

What this means

Prompts, media files, and possibly URLs you provide may be transmitted to NemoVideo's cloud service for rendering.

Why it was flagged

The skill sends selected files or URLs to an external cloud API for processing. This is central to the stated purpose, but it is a sensitive data boundary.

Skill content
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Do not upload private, confidential, copyrighted, or regulated media unless you trust the service and accept its handling of that data.