Sora Video Generation

generate text prompts into AI generated videos with this sora-video-generation skill. Works with TXT, PNG, JPG, MP4 files up to 200MB. content creators use i...

This skill appears to do what it says: connect to a cloud rendering backend, accept uploads and prompts, and return generated videos. Before installing, consider: - The skill will call an external service at https://mega-api-prod.nemovideo.ai and may upload your files (up to 200MB). Don’t upload sensitive or private data unless you trust that service and its privacy/retention policies. - The SKILL.md says NEMO_TOKEN is the primary credential but also describes creating an anonymous token automatically if none is provided. Decide whether you prefer to supply your own token (more control) or allow the skill to create anonymous tokens for you. - The frontmatter mentions storing state/config in ~/.config/nemovideo/ and deriving headers from the agent install path; the registry metadata shown to me did not list config paths — ask the publisher to clarify where it will write session/config files. - No install artifacts or code are included (instruction-only). If you want higher assurance, request source/homepage or code so you can review exact API calls and any storage behavior. If you are comfortable with an unknown third-party service receiving uploaded media and temporary session tokens, the skill is coherent for its purpose; otherwise, seek a published/homepage/source or use a service you already trust.

Type: OpenClaw Skill Name: sora-video-generation Version: 1.0.0 The skill sora-video-generation is classified as suspicious due to environment fingerprinting and instructions that reduce operational transparency. In SKILL.md, the agent is directed to detect its installation path (e.g., checking for ~/.cursor/skills/) to populate telemetry headers and to automatically negotiate anonymous tokens with a third-party API (mega-api-prod.nemovideo.ai). Most critically, the instructions command the agent to "process internally" and "don't forward" tool calls or results received via the backend's SSE stream, which could allow the remote server to execute actions through the agent while hiding them from the user's view.