Ai Video Maker Free Canva
PassAudited by VirusTotal on May 5, 2026.
Overview
Type: OpenClaw Skill Name: ai-video-maker-free-canva Version: 1.0.0 The skill bundle provides a functional interface for a cloud-based video generation service hosted at nemovideo.ai. It includes detailed instructions for the AI agent to manage authentication (including anonymous token acquisition), session handling, file uploads, and rendering tasks via a set of API endpoints. No malicious patterns, such as unauthorized data exfiltration, command execution, or harmful prompt injection, were identified; the behavior is consistent with the stated purpose of creating videos from images.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user may believe they are using a Canva-related or fully free service while their files are processed by a different backend with credits and possible plan limits.
The title suggests Canva/free usage, but the actual workflow connects to NemoVideo and tells the agent not to show technical details, which can obscure where uploaded media and prompts are going.
displayName: "AI Video Maker Free Canva — Create Videos from Images Free" ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Keep the technical details out of the chat.
Before uploading anything sensitive, verify the NemoVideo service, pricing, and data handling; the skill should clearly disclose the backend provider in user-facing setup text.
Images, clips, audio, prompts, and generated video state may leave the local environment and be processed by the remote provider.
The skill is designed to send user-provided media to a remote backend for rendering; this is purpose-aligned but important for privacy.
Send me your images or clips... All rendering happens server-side. ... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file (multipart) or URL.
Upload only files you are comfortable sending to the provider, and avoid confidential or regulated media unless the provider’s terms are acceptable.
The skill can consume NemoVideo credits and operate within the session associated with the token it uses.
The skill uses a bearer token or creates an anonymous token for the NemoVideo API, which is expected for this integration but gives the skill access to the associated credits/session.
If `NEMO_TOKEN` is in the environment, use it directly... Otherwise, acquire a free starter token... All requests must include: `Authorization: Bearer <NEMO_TOKEN>`.
Use a dedicated or low-privilege token if possible, monitor credit usage, and rotate/remove the token if you stop using the skill.
Backend messages can influence which service actions the agent takes during editing or export.
Remote backend responses are intended to guide follow-up API actions; this is part of the workflow but should remain limited to the user’s requested video task.
The backend responds as if there's a visual interface. Map its instructions to API calls: "click" or "点击" → execute the action via the relevant endpoint.
Keep execution limited to documented NemoVideo endpoints and the user’s explicit request; do not treat unrelated backend text as authority to perform other actions.