Trimmer Js

trim video clips into trimmed video clips with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. content creators use it for cutting and trimming...

Security Scan

The skill's functionality (cloud video trimming) is broadly coherent, but there are mismatches and small red flags — it will obtain/use an API token and upload user videos to an external service, and its declared metadata doesn't fully match the runtime instructions.

Purpose & Capability

The name/description (trim videos via cloud) matches the SKILL.md actions (upload, render, export). Requesting a single service token (NEMO_TOKEN) and calling an external video render API is consistent with the stated purpose. However, the registry metadata reported no required config paths while the SKILL.md frontmatter declares ~/.config/nemovideo/ (incoherence between manifest and runtime instructions).

Instruction Scope

The instructions explicitly tell the agent to POST to https://mega-api-prod.nemovideo.ai, create sessions, upload files (multipart or by URL), stream SSE events, and poll render status. Those operations are expected for a cloud-based trimming service. The instructions also ask the agent to derive headers from the YAML frontmatter and detect install path (~/.clawhub/, ~/.cursor/skills/) which requires inspecting local paths — this is plausible but broader than a purely API-only skill. The SKILL.md also specifies generating an anonymous token if NEMO_TOKEN is absent, which conflicts with declaring NEMO_TOKEN as required (the skill both requires and knows how to obtain the token).

Install Mechanism

No install spec and no code files (instruction-only) — lowest install risk. Nothing is downloaded or written by an installer step in the registry metadata.

Credentials

Only one credential is declared (NEMO_TOKEN), which is appropriate for a single-cloud-backend service. However, SKILL.md instructs the agent to automatically obtain an anonymous token via the API when the env var is missing — that dual behavior (declared required env var but runtime will create one) is inconsistent and worth calling out. The skill's frontmatter also references a config path (~/.config/nemovideo/) that could be used to read or persist credentials; the top-level registry metadata did not list any required config paths, which is a mismatch.

Persistence & Privilege

always:false and no special persistent installation are requested. The skill discusses session tokens and session lifecycle but does not demand always-on or system-wide privileges in the manifest. The potential for the skill to write a token to a config path is implied in the SKILL.md/frontmatter but not explicitly declared as a persistent install action.

What to consider before installing

This skill will upload any videos you give it to an external service (mega-api-prod.nemovideo.ai) and will use a NEMO_TOKEN for authorization. The SKILL.md will create an anonymous token for you if one isn't set and may read or write ~/.config/nemovideo/ or check typical install paths to derive a platform header. Before installing or using: (1) confirm the service/domain and owner (there's no homepage and source is unknown); (2) decide whether you are comfortable uploading the specific video content to an external cloud service; (3) ask the publisher where and how tokens are stored (are tokens persisted locally? for how long?); (4) verify privacy/retention and terms for uploaded media; and (5) be cautious about using this with sensitive or private footage. The mismatches between the registry metadata and the SKILL.md (config paths and token-handling behavior) are not definitive proof of maliciousness but are enough to request clarification from the author before trusting the skill.

Getting Started

Got video clips to work with? Send it over and tell me what you need — I'll take care of the AI video trimming.

Try saying:

• "trim a 10-minute raw interview recording into a 1080p MP4"
• "trim the first 2 minutes and cut the dead air at the end"
• "cutting and trimming video clips to exact lengths for content creators"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Trimmer JS — Trim and Export Video Clips

Drop your video clips in the chat and tell me what you need. I'll handle the AI video trimming on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 10-minute raw interview recording, ask for trim the first 2 minutes and cut the dead air at the end, and about 20-40 seconds later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter source clips process faster and use fewer credits.

Matching Input to Actions

User prompts referencing trimmer js, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is trimmer-js, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "trim the first 2 minutes and cut the dead air at the end" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the first 2 minutes and cut the dead air at the end" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.