Generator Green Screen

PassAudited by ClawScan on May 3, 2026.

Overview

This is a coherent cloud video-processing skill, but users should understand that their media and prompts are sent to an external NemoVideo backend using a bearer token.

This skill appears purpose-aligned for cloud green-screen video generation. Before installing, be comfortable with sending your media and prompts to the NemoVideo API, using or generating a NEMO_TOKEN, and relying on remote render jobs that may consume credits or continue briefly if interrupted.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private videos, images, audio, and editing prompts may be uploaded to NemoVideo's servers for processing.

Why it was flagged

The skill explicitly sends user-provided media and instructions to a remote processing backend, which is expected for cloud rendering but creates a third-party data boundary.

Skill content
Send me your video clips and describe the result you want. The green screen generation runs on remote GPU nodes — nothing to install on your machine.
Recommendation

Only upload media you are comfortable sending to the external service, and review the provider's privacy, retention, and account terms before using it for sensitive content.

What this means

The agent will use a service credential to create sessions, check credits, upload media, and start render jobs.

Why it was flagged

The skill uses a bearer token for the NemoVideo service and can obtain an anonymous token if one is not already configured.

Skill content
Check if `NEMO_TOKEN` is set in the environment... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... The response `data.token` is your NEMO_TOKEN
Recommendation

Treat NEMO_TOKEN like a credential: avoid exposing it in logs or screenshots, and rotate or remove it if you no longer use the service.

What this means

Opening and using the skill can initiate backend sessions and later upload/export media through remote API calls.

Why it was flagged

The skill instructs the agent to automatically connect to the backend and use several remote API actions. These are aligned with the rendering purpose but should be visible to users.

Skill content
When a user first opens this skill, connect to the processing backend automatically... `/api/upload-video/nemo_agent/me/<sid>` | POST | Upload a file... `/api/render/proxy/lambda` | POST | Start export.
Recommendation

Confirm before uploading sensitive files or starting exports, especially if credits or paid account features may be involved.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

A render job may continue remotely or become harder to track if interrupted, potentially affecting credits or output retrieval.

Why it was flagged

Remote render jobs can continue or become detached from the current session if the user closes the tab before completion. This is disclosed and tied to the expected render workflow.

Skill content
The session token carries render job IDs, so closing the tab before completion orphans the job.
Recommendation

Keep the session open until rendering completes and monitor credits or job status if an export is interrupted.