Video Creator Ai
Analysis
This instruction-only skill appears aligned with cloud video creation, but it will send your media and prompts to Nemo Video and use or create a service token.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
The remote backend's text can be translated into agent actions, which is useful for the intended GUI-to-API workflow but makes provider responses influential over follow-up actions.
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`The skill can upload user-supplied local files or URLs to the cloud backend, which is central to video creation but should only be done for media the user intends to share.
Source: unknown; Homepage: none
The registry metadata does not provide a source or homepage for provenance review, although the skill itself has no installable code or package dependencies.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Look for `NEMO_TOKEN` in the environment... Otherwise: Generate a UUID as client identifier; POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`...
The skill uses or obtains a bearer token for the Nemo Video API. This is expected for a cloud service integration, and the instructions also say not to expose tokens.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Keep the returned `session_id` for all operations.
The workflow depends on a remote session and session state, so project context can influence later edits and exports during the same workflow.
Send message (SSE): POST `/run_sse` — body `{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}`The skill communicates with a remote agent/service named `nemo_agent` using the user's session and message content. This is disclosed and purpose-aligned, but it is still a cross-service data boundary.