4k Subtitle Generator

generate video files into captioned 4K videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers and video creators use it for addi...

Security Scan

The skill's stated purpose (remote subtitle/rendering) mostly matches its runtime instructions, but there are a few incoherent or privacy-sensitive behaviors (filesystem fingerprinting, automatic token creation/storage, vague token storage) that warrant caution before installing.

Purpose & Capability

The name/description (generate subtitles and render 4K video) align with the instructions to upload media and call a remote rendering API (nemovideo). Requesting a single service token (NEMO_TOKEN) and a nemovideo config path is expected. However, the SKILL.md instructs creating attribution headers that require detecting the agent's install path (~/.clawhub/, ~/.cursor/skills/) — that filesystem access is outside the declared configPaths and is not strictly required to perform subtitle rendering, so it is unexpected.

Instruction Scope

Instructions include network flows that are consistent with the service (auth, session creation, upload, SSE, render). Concerns: (1) the skill directs the agent to detect install paths to populate X-Skill-Platform (reads user's filesystem beyond declared configPaths); (2) it tells the agent to auto-provision an anonymous token if NEMO_TOKEN is not present and to 'store' the returned token/session_id without specifying secure storage or retention policy; (3) it explicitly instructs the agent not to display raw API responses or token values to the user — while reasonable for UX, that also hides evidence of token issuance and use and could conceal exfiltration if malicious. Reading and sending environment/installation metadata to the backend is a privacy/fingerprinting risk.

Install Mechanism

No install spec and no code files — instruction-only skill. This minimizes local code execution risk. All operations occur via remote API calls described in the SKILL.md.

Credentials

The skill only declares a single required env var: NEMO_TOKEN (primary credential), which is proportionate to a remote rendering service. However, the runtime instructions also create/retain an anonymous token if none exists, and they require reading the skill frontmatter and possibly scanning install paths to build attribution headers. Those additional filesystem reads are not declared as required env/config and increase fingerprinting/privacy exposure beyond the single service token.

Persistence & Privilege

always is false and the skill is user-invocable (normal). The SKILL.md instructs storing session_id and tokens for later requests; this is expected for service sessions but the spec does not say where/how to store them (secure storage, lifetime, or cleanup). Autonomous invocation is allowed (platform default) — combined with network access this means the skill could make API calls on its own, so confirm you trust the remote service. The skill does not request persistent installation or modify other skills.

What to consider before installing

This skill appears to actually perform remote subtitle generation via nemovideo.ai and asks for a service token (NEMO_TOKEN). Before installing or using it: (1) Verify the backend domain (mega-api-prod.nemovideo.ai) is a legitimate service you trust — you will upload your video and metadata to it. (2) Ask the author to clarify where tokens/session IDs are stored, how long they are retained, and whether they are stored encrypted. (3) Confirm why the skill needs to read your home/install paths to set X-Skill-Platform — this is fingerprinting data and not necessary for core subtitle work. (4) If your videos are sensitive, do not upload until you get privacy/retention details (who can access stored media, retention period). (5) If you prefer, set NEMO_TOKEN yourself rather than allowing anonymous token creation, and confirm the skill will not read or send any other files or system config. These clarifications would reduce the outstanding concerns.

Getting Started

Ready when you are. Drop your video files here or describe what you want to make.

Try saying:

• "generate a 3-minute 4K interview recording into a 4K MP4"
• "generate subtitles for my 4K video and burn them into the footage"
• "adding subtitles to 4K videos for YouTube or streaming for YouTubers and video creators"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

4K Subtitle Generator — Generate Subtitles for 4K Videos

Send me your video files and describe the result you want. The AI subtitle generation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 3-minute 4K interview recording, type "generate subtitles for my 4K video and burn them into the footage", and you'll get a 4K MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter clips under 5 minutes generate subtitles significantly faster.

Matching Input to Actions

User prompts referencing 4k subtitle generator, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Skill attribution — read from this file's YAML frontmatter at runtime:

• X-Skill-Source: 4k-subtitle-generator
• X-Skill-Version: from frontmatter version
• X-Skill-Platform: detect from install path (~/.clawhub/ → clawhub, ~/.cursor/skills/ → cursor, else unknown)

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate subtitles for my 4K video and burn them into the footage" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for widest compatibility across platforms.

Common Workflows

Quick edit: Upload → "generate subtitles for my 4K video and burn them into the footage" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.