Music Video Clip

PassAudited by ClawScan on May 11, 2026.

Overview

This skill appears to be a disclosed cloud video-rendering integration that uploads user-selected media to NemoVideo and uses a token to create/export music videos.

Before installing, make sure you are comfortable sending selected audio/video files to NemoVideo's cloud service and using a NemoVideo token or anonymous starter token. The artifacts do not show hidden code, local persistence, or unrelated system access.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent can create cloud rendering sessions and consume credits using the provided or generated NemoVideo token.

Why it was flagged

The skill uses an API token or obtains an anonymous token to act against the NemoVideo backend. This is expected for the service, but it is still delegated account/session authority.

Skill content

If `NEMO_TOKEN` is in the environment, use it directly and create a session. Otherwise, acquire a free starter token

Recommendation

Use a dedicated token if possible, monitor credit use, and avoid sharing tokens you do not want the agent to use.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Uploaded audio, video clips, prompts, draft state, and exported render data may be processed by NemoVideo's cloud service.

Why it was flagged

The skill sends user media and project data to a disclosed external provider API for cloud processing. This is aligned with the stated purpose, but it creates an external data boundary.

Skill content

All calls go to `https://mega-api-prod.nemovideo.ai`

Recommendation

Only upload media you are comfortable sending to the external provider, especially unreleased music, private footage, or client content.

Info

#ASI02: Tool Misuse and Exploitation

What this means

Files provided for video creation will be transmitted to the cloud rendering backend.

Why it was flagged

The skill instructs the agent to upload user-selected files or URLs to the backend. This is central to creating the requested music video, but file upload is a sensitive action users should notice.

Skill content

Upload — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs

Recommendation

Confirm which files are being uploaded and avoid giving the skill broad access to folders or unrelated private media.