Video Generation Ai Tools
PassAudited by ClawScan on May 10, 2026.
Overview
This skill is a coherent cloud video-generation integration, but users should understand that prompts and selected media are sent to a third-party video API using a NEMO_TOKEN credential.
Before installing, make sure you are comfortable sending prompts and selected media files to the NemoVideo cloud API and using a NEMO_TOKEN for authentication. Avoid uploading sensitive or confidential media unless you trust the provider's handling of that data.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The video provider can associate requests and generated jobs with the token used by the skill.
The skill uses a provider token to authenticate to the video service. This is expected for the stated cloud-video purpose and is disclosed, but it is still account/session authority users should understand.
Check if `NEMO_TOKEN` is set in the environment... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN
Use a token intended for this service only, avoid sharing token values, and rotate/remove it if you no longer use the skill.
Files or URLs you provide for video generation will be sent to the NemoVideo cloud service for processing.
The skill can upload local files or URLs to the remote provider. This is central to video generation and appears user-directed, but it means selected media leaves the local environment.
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Only upload media you are comfortable sending to the third-party provider, especially if it contains private, confidential, or licensed content.
The agent may perform additional video-editing or export steps based on the video backend's responses rather than only showing those responses to you.
The skill tells the agent to interpret backend GUI-style responses as follow-up API actions. This is consistent with the provider workflow, but it makes provider responses operationally authoritative within the task.
Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow
For important outputs, review generated drafts or ask for confirmation before export if you want tighter control over the workflow.