Tiktok Video Converter

ReviewAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill appears aligned with cloud video conversion, but it uses a NemoVideo token/session and sends user-provided videos to a third-party API.

This skill does not install local code, but it does connect to NemoVideo, use or create a NEMO_TOKEN, and upload videos for cloud processing. Install only if you are comfortable sending the selected clips to that provider and using its token/credit system.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can authenticate to the NemoVideo service and use the token/session for video processing and credits.

Why it was flagged

The skill declares a NemoVideo credential and a NemoVideo config path as part of its authentication setup.

Skill content

requires": {"env": ["NEMO_TOKEN"], "configPaths": ["~/.config/nemovideo/"]}, "primaryEnv": "NEMO_TOKEN"

Recommendation

Use a token intended for this service only, do not paste or log it, and avoid sharing conversations or logs that may contain credential details.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Any clips you upload for conversion leave your local environment and are processed by the provider's cloud service.

Why it was flagged

The skill discloses that uploaded videos or URLs are sent to an external provider API for processing.

Skill content

All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.

Recommendation

Upload only videos you intend to send to this provider, and avoid using sensitive or private media unless you trust the service's handling and retention practices.

Low

#ASI01: Agent Goal Hijack

What this means

Some edits or exports may be triggered through backend-directed internal API steps rather than explicit visible user clicks.

Why it was flagged

The instructions make backend text responses authoritative for internal API actions, including export, as part of translating GUI-style backend behavior.

Skill content

Backend says | You do ... "click [button]" / "点击" | Execute via API ... "Export button" / "导出" | Execute export workflow

Recommendation

For credit-consuming or final export actions, ask the agent to summarize the pending action and confirm before proceeding.