Text To Video Ai Tools

PassAudited by ClawScan on May 5, 2026.

Overview

This is a cloud text-to-video connector that uses a NemoVideo token and sends user prompts/files to a remote backend; the provided artifacts do not show hidden or destructive behavior, but users should understand the API/data sharing.

This skill appears purpose-aligned for cloud text-to-video generation. Before installing, make sure you are comfortable sending prompts and uploaded files to mega-api-prod.nemovideo.ai, using or generating a NemoVideo token, and allowing the skill to perform session, upload, render, and export API steps on your behalf.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anyone using this skill should understand that the token may allow actions against their NemoVideo session or credits.

Why it was flagged

The skill uses a bearer token to authenticate to the remote NemoVideo service. This is expected for the integration, but it is still account/session authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly and create a session.
Recommendation

Use a dedicated or least-privileged token if available, and avoid sharing sensitive account tokens in untrusted environments.

What this means

Uploaded scripts, prompts, media, or documents may be processed and stored by the remote video-generation service.

Why it was flagged

The workflow sends user prompts/files and session data to a remote provider. This is central to cloud video generation, but it means user content leaves the local environment.

Skill content
API base: `https://mega-api-prod.nemovideo.ai` ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Recommendation

Do not upload confidential or regulated material unless you trust the provider and its data-handling terms.

What this means

The skill may perform workflow steps such as editing, querying state, or exporting without spelling out every backend action in chat.

Why it was flagged

The agent is instructed to convert backend workflow messages into follow-up API actions. The actions appear limited to the video workflow, but users should be aware that the integration may act automatically within that session.

Skill content
Backend says "click [button]" / "点击" | You do | Execute via API
Recommendation

Ask the agent to summarize planned actions before generation or export if you want tighter control.

What this means

A user may not see exactly when the skill creates a backend session or uses a token unless they ask.

Why it was flagged

The skill favors a simplified user experience and may not surface token/session/API details during normal use. This is not necessarily deceptive because the API details are disclosed in the artifact, but it reduces runtime transparency.

Skill content
Tell the user you're ready. Keep the technical details out of the chat.
Recommendation

If transparency matters, ask the agent to show connection, upload, and export steps before performing them.

What this means

Users have limited provenance information for verifying who maintains the skill or its backend integration.

Why it was flagged

The registry information does not provide a source repository or homepage for independent verification. There are no code files to install, but the skill still depends on a remote API and credential.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider and token destination before using the skill with important accounts or sensitive uploads.