Text To Video Benchmark

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is coherent for cloud text-to-video rendering, but users should know it uses a NemoVideo token and sends selected prompts or files to an external backend.

This appears acceptable if you intend to use NemoVideo’s cloud backend. Before installing, be comfortable with creating or using a NEMO_TOKEN and sending selected prompt files or media to the provider. Avoid uploading confidential data unless you have reviewed the provider’s privacy and retention practices.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Video generation, credits, and session actions run under the NemoVideo token available to the agent.

Why it was flagged

The skill uses or creates a provider bearer token for NemoVideo API access. This is expected for the service, but it is still credentialed account/session authority.

Skill content
Look for `NEMO_TOKEN` in the environment. If found, skip to session creation. Otherwise: ... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... this is your NEMO_TOKEN
Recommendation

Use a token intended only for this service, avoid exposing it in chat or logs, and rotate or remove it if you stop using the skill.

What this means

Prompts, documents, CSV/JSON data, media files, or URLs you provide may be transmitted to and processed by NemoVideo.

Why it was flagged

The workflow sends user-selected files or URLs to an external cloud backend for processing.

Skill content
Upload your text prompts (TXT, DOCX, CSV, JSON, up to 500MB) ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL
Recommendation

Only upload content you are comfortable sending to that provider, and avoid secrets, private customer data, or regulated data unless you have reviewed the provider’s terms and privacy controls.

What this means

A generation or export request may create remote render jobs and keep polling until completion.

Why it was flagged

The skill instructs the agent to run multi-step remote API workflows, including long-running SSE calls and polling for render completion. This is aligned with cloud rendering, but it can consume time or service credits.

Skill content
**Send message (SSE)**: POST `/run_sse` ... Max timeout: 15 minutes. ... **Export** ... Poll GET `/api/render/proxy/lambda/<id>` every 30s until `status` = `completed`.
Recommendation

Confirm large uploads or expensive renders before proceeding, monitor credits/status, and keep the session available until the job completes.

What this means

The external service’s responses may influence follow-up actions such as editing, querying state, or exporting a render.

Why it was flagged

Provider-generated responses can guide follow-up API actions inside the same service. The behavior is disclosed and purpose-aligned, but the agent should not treat backend text as authority to exceed the user's request.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: ... "click" ... → execute the action via the relevant endpoint ... "Export" ... → run the export workflow
Recommendation

Keep backend-directed actions within the user’s stated intent and ask for confirmation before materially changing, exporting, or spending credits on a project.