Music Video Clip

• Analyzed: May 11, 2026, 4:21 PM
• Findings: 1
• Version: 1.0.0
• Hash: 2928c47ea0759ceb7cb871beb2cee909cacd5bad91cd97c2e0fbdae6725312f2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The music-video-clip skill (SKILL.md) connects to a third-party API at mega-api-prod.nemovideo.ai to generate synced music videos. It is classified as suspicious due to instructions that direct the agent to 'process internally' tool calls received from a remote Server-Sent Events (SSE) stream, which could allow a compromised backend to trigger unauthorized actions on the host. Furthermore, the skill requires the agent to auto-detect its platform from the installation path for telemetry and manages authentication via the NEMO_TOKEN environment variable, representing a significant attack surface despite being aligned with the stated functionality.