Text To Video Models

The declared purpose (text-to-video generation) matches the API endpoints and flows described in SKILL.md and the single required credential (NEMO_TOKEN). However the SKILL.md frontmatter lists a required config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — an inconsistency between packaging and runtime instructions that should be clarified.

Instructions tell the agent to create or use a bearer token, upload user files (up to 500MB) and send them to https://mega-api-prod.nemovideo.ai, start render jobs, read SSE streams, and poll state. Uploading arbitrary user files and session state to an external service is expected for this kind of skill, but it is sensitive: users' uploads and generated tokens will be sent off-platform. The doc also asks to auto-detect an install path for X-Skill-Platform attribution (vague) and requires specific attribution headers on every request — this is operationally fine but enforces outgoing requests that identify the skill. The instructions do not ask for unrelated local files or secrets, but the file-upload and token-creation behaviors are the primary privacy/risk surface.

There is no install spec and no code files — the skill is instruction-only. That minimizes disk/installation risk because nothing will be downloaded or written by an installer.

Only one env var (NEMO_TOKEN) is declared as required/primary, which is proportionate for a cloud API client. The SKILL.md also documents a fallback anonymous-token flow (generates a UUID and obtains a temporary token), which means the skill can operate without a user-provided secret. The discrepancy between the registry's 'no config paths' and the frontmatter's configPaths entry (~/.config/nemovideo/) should be resolved — requesting access to a user's config directory would be more sensitive and needs justification.

always is false and the skill does not request persistent platform-level privileges. Autonomous invocation is allowed (platform default) — combined with outbound network access this increases blast radius but is normal for an API-based generator. The skill does not claim to modify other skills or system-wide settings.