To No Generator
PassAudited by ClawScan on May 12, 2026.
Overview
This skill appears to be a purpose-aligned cloud text-to-video integration, but users should know it sends prompts/files to NemoVideo and uses a bearer token.
This skill is reasonable for cloud text-to-video generation. Before installing, be comfortable sending your prompts and uploaded files to NemoVideo, protect the NEMO_TOKEN, and avoid using confidential documents or media unless you trust the provider.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Text, scripts, PDFs, videos, or other uploaded content may leave the local environment and be processed by the provider.
The skill sends user prompts and selected files to an external NemoVideo cloud service for processing. This is expected for text-to-video generation, but it creates an external data boundary.
This skill connects to a cloud processing backend ... Upload: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`
Only upload files you intend to send to NemoVideo, and avoid confidential material unless you trust the provider's privacy and retention practices.
Anyone with the token could potentially access or use the associated NemoVideo session or credits until the token expires or is revoked.
The skill uses or creates a bearer token for the external service. This is purpose-aligned, but the token grants access to the user's generated session and credits.
Look for `NEMO_TOKEN` in the environment... Otherwise: Generate a UUID... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Treat NEMO_TOKEN like a password, do not share it, and rotate or remove it if exposed.
A loosely worded request could trigger generation or export actions within the NemoVideo workflow.
The skill instructs the agent to classify user messages and backend GUI-style responses into API operations such as generation, state checks, uploads, and exports. This is normal for the skill's purpose, but it means actions may be taken based on interpreted intent.
User prompts... get routed to the corresponding action... `Export` or `导出` → run the export workflow
Give explicit instructions about what to generate, upload, or export, and ask the agent to confirm before processing sensitive files or final exports if needed.