Text To Video Higgsfield

• Risk level: Low
• Analyzed: Apr 12, 2026, 9:14 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill's required credential and network calls are consistent with a cloud video-generation integration; nothing requested is disproportionate, but the skill will send user files and tokens to an external API and has a minor metadata inconsistency worth noting.

This skill appears internally consistent for a cloud text→video service: it will use NEMO_TOKEN (if present) or obtain an anonymous token from the vendor, create a session, and upload any user files you provide to mega-api-prod.nemovideo.ai for rendering. Before installing or enabling it, consider: (1) privacy — any images, videos, or text you upload will be sent to the external service; (2) credentials — if you set NEMO_TOKEN as an env var, the skill will use it for all requests (only provide tokens you trust); (3) attribution metadata — the skill sends X-Skill-* headers and attempts to detect the agent install path (this reveals some environment info); (4) verify the vendor/domain and terms of service if you care about content ownership or retention; and (5) the SKILL.md includes a small metadata mismatch about a config path (harmless but worth noting). If any of those are unacceptable, do not provide credentials or avoid uploading sensitive files.