Ai Video Generator Free Trial

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a cloud video-generation connector, but it will use a NemoVideo token and send selected prompts/files to a remote API.

Install only if you are comfortable using mega-api-prod.nemovideo.ai for cloud rendering. Use a dedicated/free-trial token, do not upload confidential media, and confirm any unexpected export or upload behavior.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The service token can be used to access the user's video-generation session and free-trial credits.

Why it was flagged

The skill uses or obtains a provider bearer token for the NemoVideo API. This is expected for the cloud video service, but it is still account/session authority.

Skill content
Every API call needs `Authorization: Bearer <NEMO_TOKEN>` ... Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... this is your NEMO_TOKEN
Recommendation

Use a dedicated token or free-trial session, keep the token private, and revoke or rotate it if it is exposed.

What this means

Uploaded images, videos, audio, URLs, and prompt text may be processed and stored by the remote provider.

Why it was flagged

The skill sends user-selected files or URLs to a remote backend for video generation. This is central to the stated purpose, but it creates a third-party data-sharing boundary.

Skill content
Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`
Recommendation

Only upload assets you are comfortable sending to the provider, and avoid private, regulated, or confidential media unless the provider's terms are acceptable.

What this means

Unexpected backend instructions could cause extra provider-side actions such as edits, state queries, or exports within the active session.

Why it was flagged

Remote backend responses are treated as workflow instructions for provider API calls. This appears limited to the video-generation session, but it means provider messages can drive agent actions.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: - "click" ... → execute the action via the relevant endpoint ... - "Export" ... → run the export workflow
Recommendation

Keep actions tied to the user's explicit video request, and ask for confirmation before unexpected exports, uploads, or major changes.

What this means

Users have less context for deciding whether to trust the external service and its API behavior.

Why it was flagged

There is no local package to install, but the skill has limited provenance information for users to verify the publisher or service independently.

Skill content
Source: unknown; Homepage: none; No install spec — this is an instruction-only skill.
Recommendation

Verify the provider and terms separately before uploading valuable or sensitive content.