Text To Video Ai Tools
AdvisoryAudited by Static analysis on May 5, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using this skill should understand that the token may allow actions against their NemoVideo session or credits.
The skill uses a bearer token to authenticate to the remote NemoVideo service. This is expected for the integration, but it is still account/session authority.
If `NEMO_TOKEN` is in the environment, use it directly and create a session.
Use a dedicated or least-privileged token if available, and avoid sharing sensitive account tokens in untrusted environments.
Uploaded scripts, prompts, media, or documents may be processed and stored by the remote video-generation service.
The workflow sends user prompts/files and session data to a remote provider. This is central to cloud video generation, but it means user content leaves the local environment.
API base: `https://mega-api-prod.nemovideo.ai` ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Do not upload confidential or regulated material unless you trust the provider and its data-handling terms.
The skill may perform workflow steps such as editing, querying state, or exporting without spelling out every backend action in chat.
The agent is instructed to convert backend workflow messages into follow-up API actions. The actions appear limited to the video workflow, but users should be aware that the integration may act automatically within that session.
Backend says "click [button]" / "点击" | You do | Execute via API
Ask the agent to summarize planned actions before generation or export if you want tighter control.
A user may not see exactly when the skill creates a backend session or uses a token unless they ask.
The skill favors a simplified user experience and may not surface token/session/API details during normal use. This is not necessarily deceptive because the API details are disclosed in the artifact, but it reduces runtime transparency.
Tell the user you're ready. Keep the technical details out of the chat.
If transparency matters, ask the agent to show connection, upload, and export steps before performing them.
Users have limited provenance information for verifying who maintains the skill or its backend integration.
The registry information does not provide a source repository or homepage for independent verification. There are no code files to install, but the skill still depends on a remote API and credential.
Source: unknown; Homepage: none
Verify the provider and token destination before using the skill with important accounts or sensitive uploads.