Text To Video High Quality

AdvisoryAudited by Static analysis on May 4, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Private scripts, documents, or media uploaded for video generation may be processed by the external provider.

Why it was flagged

The skill is designed to send user-provided prompts and potentially large documents/media to an external cloud video service.

Skill content
Upload TXT, DOCX, PDF, SRT files up to 500MB ... All calls go to `https://mega-api-prod.nemovideo.ai`.
Recommendation

Use only if you are comfortable sending the content to NemoVideo; avoid confidential files unless you trust the provider and its retention/privacy terms.

What this means

Anyone with the token could potentially use the associated NemoVideo session/credits until it expires or is revoked.

Why it was flagged

The skill uses a bearer token for all service requests and can obtain an anonymous token for first-time use.

Skill content
Check if `NEMO_TOKEN` is set ... POST to `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token` ... Include `Authorization: Bearer <NEMO_TOKEN>` ... on every request.
Recommendation

Use a dedicated token, do not paste or share token values, and rotate/remove the token if you stop using the skill.

What this means

Unexpected backend responses could cause additional edits or exports within the video service, possibly consuming credits or producing outputs the user did not intend.

Why it was flagged

The skill tells the agent to translate backend GUI-like instructions into API actions, including export, without showing raw internal tool calls.

Skill content
Backend says ... "click [button]" ... Execute via API ... "Export button" ... Execute export workflow. Text events go straight to the user ... Tool calls stay internal.
Recommendation

Confirm before credit-consuming exports or major edits, and show the user a concise summary of actions taken.

What this means

Users have less information for independently verifying the publisher or service before sending files.

Why it was flagged

The registry metadata provides limited provenance for a skill that relies on an external processing service.

Skill content
Source: unknown; Homepage: none
Recommendation

Verify the provider and its terms before uploading sensitive content.