Text From Video

PassAudited by VirusTotal on May 3, 2026.

Overview

Type: OpenClaw Skill Name: text-from-video Version: 1.0.0 The skill bundle is a functional wrapper for the NemoVideo AI service, designed to extract transcripts and render videos via a remote API (mega-api-prod.nemovideo.ai). It implements a standard SaaS integration pattern, including session management, multipart file uploads, and an anonymous authentication flow for trial users. While it requests environment discovery for attribution (X-Skill-Platform) and uses a remote backend for processing, its behavior is transparently documented and aligns with its stated purpose for content creators.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Requests may be associated with a Nemo account or anonymous token, and some actions may depend on available credits or subscription status.

Why it was flagged

The skill uses a service credential or creates an anonymous token to operate the remote video service. This is expected for the integration, but it is still delegated account/session authority.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly ... Otherwise, acquire a free starter token ... The response includes a `token` with 100 free credits valid for 7 days
Recommendation

Use a dedicated or scoped token where possible, avoid sharing the token, and monitor credits or account activity for the Nemo service.

What this means

Private or sensitive videos, audio, images, and prompt text could be processed by a third-party service.

Why it was flagged

The artifact clearly sends user-provided videos and prompts to an external backend for processing. This is purpose-aligned, but the supplied artifacts do not describe retention, privacy, or access boundaries for uploaded media.

Skill content
The AI text extraction runs on remote GPU nodes — nothing to install on your machine. ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Recommendation

Only upload media you are comfortable sending to nemovideo.ai, and check the provider's privacy and retention terms before using it with confidential content.

What this means

A user request may lead to remote editing, rendering, exporting, or credit-related operations inside the Nemo session.

Why it was flagged

The skill tells the agent to translate provider-style GUI responses into remote API actions. This appears scoped to the same video-processing service, but users should understand that exports or edits can be triggered through the workflow.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: - "click" or "点击" → execute the action via the relevant endpoint ... - "Export" or "导出" → run the export workflow
Recommendation

Confirm before running exports, non-transcription edits, or credit-consuming operations, especially when using a paid or registered token.