Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Editeur Video Test

v1.0.0

Get edited video clips ready to post, without touching a single slider. Upload your raw video clips (MP4, MOV, AVI, WebM, up to 500MB), say something like "t...

0· 56·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for francemichaell-15/editeur-video-test.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Editeur Video Test" (francemichaell-15/editeur-video-test) from ClawHub.
Skill page: https://clawhub.ai/francemichaell-15/editeur-video-test
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install editeur-video-test

ClawHub CLI

Package manager switcher

npx clawhub@latest install editeur-video-test
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name and description claim remote AI video editing and the SKILL.md describes API endpoints for upload, edit, render and credits — the single declared credential (NEMO_TOKEN) is appropriate for that purpose.
Instruction Scope
Instructions are detailed and focused on calling the remote nemovideo API, SSE handling, uploads, and polling. However the skill requires embedding attribution headers and 'auto-detecting' platform from the install path, which implies the agent may need to access its install path or filesystem. The SKILL.md also instructs storing session_id and tokens (persistence behavior is implied but not fully specified).
Install Mechanism
No install spec or binaries — instruction-only skill. This is the lowest-risk install mechanism (nothing is downloaded or written by an installer).
!
Credentials
Declared primary credential is NEMO_TOKEN which is coherent. But the frontmatter in SKILL.md includes a configPaths entry (~/.config/nemovideo/) while the registry metadata reported no required config paths — this mismatch is unexplained. Granting read/write access to a home config directory could persist tokens or other data and is disproportionate to a pure ephemeral editing session unless explicitly justified.
Persistence & Privilege
always: false and no installs are good. Still, the instructions imply generating/storing anonymous tokens and session_id (and frontmatter references a config path), so the skill may persist state on the host. That persistence is reasonable for session convenience but should be explicit and limited to the skill's own config directory.
What to consider before installing
This skill appears to call a remote video-editing API and only asks for a NEMO_TOKEN credential — that is consistent. Before installing: 1) Confirm the API domain (mega-api-prod.nemovideo.ai) is legitimate for the service you expect. 2) Ask the publisher why the SKILL.md frontmatter references ~/.config/nemovideo/ while the registry showed no config paths — understand what will be written there and whether tokens or session IDs will be persisted. 3) If you have security concerns, avoid setting a long‑lived NEMO_TOKEN in your global environment; use a disposable token or the anonymous flow for testing and remove stored files after use. 4) Test with non-sensitive sample videos first and verify no unexpected files are written or data exfiltrated. If the publisher can't justify the config path persistence and platform auto-detection behavior, treat this as a blocker.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk978zzqpy4r7k52e5xzgdsm8wh8513ed
56downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Got raw video clips to work with? Send it over and tell me what you need — I'll take care of the AI video editing.

Try saying:

  • "edit a 2-minute test footage recorded on a smartphone into a 1080p MP4"
  • "trim unnecessary parts, add transitions, and export a clean final cut"
  • "testing AI video editing features before committing to a full project for content creators and marketers"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Editor Test — Test and Export Edited Videos

Send me your raw video clips and describe the result you want. The AI video editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute test footage recorded on a smartphone, type "trim unnecessary parts, add transitions, and export a clean final cut", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: use a short test clip under 60 seconds to get results faster and evaluate the tool efficiently.

Matching Input to Actions

User prompts referencing editeur video test, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

EndpointMethodPurpose
/api/tasks/me/with-session/nemo_agentPOSTStart a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_ssePOSTSend a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>POSTUpload a file (multipart) or URL.
/api/credits/balance/simpleGETCheck remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latestGETFetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambdaPOSTStart export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourceediteur-video-test
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "trim unnecessary parts, add transitions, and export a clean final cut" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim unnecessary parts, add transitions, and export a clean final cut" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.

Comments

Loading comments...