Generator From Text
AdvisoryAudited by Static analysis on May 3, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill can act within the NemoVideo service using the token, including creating sessions, checking credits, uploading content, and rendering or exporting videos.
The skill uses a bearer token and can create an anonymous provider token if one is not already present. This is expected for the cloud service, but it gives the agent delegated access to the user's NemoVideo session and credits.
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Extract `data.token` from the response — this is your NEMO_TOKEN
Use a dedicated token or anonymous session for this skill, do not share the token, and monitor provider credits or account activity.
Private prompts, documents, or media uploaded for video creation may leave the local environment and be processed by the NemoVideo backend.
User-provided text or files are sent to an external cloud backend for processing. This is central to the skill's purpose and is disclosed, but it is still a sensitive data flow.
This skill connects to a cloud processing backend... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Avoid uploading confidential, regulated, or proprietary content unless you trust the provider and have reviewed its privacy and retention practices.
The agent may perform service actions like querying state, editing through SSE, or exporting videos as part of the generation workflow.
The skill tells the agent to translate backend UI-style messages into API actions. This appears purpose-aligned for automating a cloud video editor, but users should know the backend can drive workflow steps such as exporting.
Backend says: "click [button]" / "点击" | You do: Execute via API ... "Export button" / "导出" | Execute export workflow
Confirm uploads, exports, or credit-consuming actions when content or cost matters, and keep generated output under user review before posting.