Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Editor Ai Hindi

v1.0.0

Cloud-based editor-ai-hindi tool that handles adding Hindi subtitles and editing videos for Indian audiences. Upload MP4, MOV, AVI, WebM files (up to 500MB),...

0· 59·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to be a cloud video editor and only requests a single API token (NEMO_TOKEN), which is consistent. However the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata lists no config paths — an inconsistency worth asking the author about. The header attribution behavior (X-Skill-Platform derived from install path) is not strictly required for video editing and leaks local environment details.
!
Instruction Scope
Instructions tell the agent to read NEMO_TOKEN from env (expected) and, if absent, to call an anonymous-token endpoint to obtain one (expected for anonymous access). They also instruct detecting the agent's install path (~/.clawhub/, ~/.cursor/skills/) and using it in request headers and reference the YAML frontmatter for header values — this implies reading local paths and possibly user config files. Upload instructions accept local filesystem paths for multipart upload; ensure the agent only sends files the user explicitly provided. These behaviors expand the skill's runtime scope beyond simple API calls and can leak environment/installation details to the remote service.
Install Mechanism
There is no install spec and no code files — this is instruction-only, which is the lowest install risk (nothing is written to disk by the skill itself).
Credentials
Only NEMO_TOKEN is declared as required, which matches the purpose. But the SKILL.md also references a config path and install-path detection which may cause the agent to read ~/.config/nemovideo/ or probe home-directory paths; that access is not justified by the minimal credential requirement and could expose local environment details to the remote API. The anonymous-token flow will contact the vendor endpoint and produce a token valid for 7 days — understand where that token is stored and how it is used.
Persistence & Privilege
The skill does not request always:true and does not claim to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not combined with unusual privileges here.
What to consider before installing
This skill mostly does what it says (cloud video editing) and needs a NEMO_TOKEN to call the vendor API, but ask yourself whether you trust the endpoint (https://mega-api-prod.nemovideo.ai). Before installing: (1) confirm the token's origin and scope — avoid setting sensitive credentials in your environment unless necessary; (2) know that the skill may probe your install path and a local config directory (~/.config/nemovideo/) and send that info to the vendor as headers; (3) only upload files you intend to send (the skill can accept local file paths or URLs); (4) ask the publisher why registry metadata and SKILL.md disagree about config paths and whether the install-path header is required; and (5) if you are uncomfortable with environment/config probing, do not set NEMO_TOKEN globally and prefer using ephemeral/anonymous tokens or a sandboxed environment.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk976z7q4af5h8f227rqq2pv4ex84jdkh
59downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Share your raw video footage and I'll get started on AI Hindi video editing. Or just tell me what you're thinking.

Try saying:

  • "edit my raw video footage"
  • "export 1080p MP4"
  • "edit this video and add Hindi"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

AI Video Editor Hindi — Edit Videos with Hindi Captions

Drop your raw video footage in the chat and tell me what you need. I'll handle the AI Hindi video editing on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 2-minute vlog recorded on a smartphone, ask for edit this video and add Hindi subtitles automatically, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 3 minutes generate Hindi captions more accurately.

Matching Input to Actions

User prompts referencing editor ai hindi, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is editor-ai-hindi, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Common Workflows

Quick edit: Upload → "edit this video and add Hindi subtitles automatically" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "edit this video and add Hindi subtitles automatically" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across Indian social platforms.

Comments

Loading comments...