Video Making

Skip the learning curve of professional editing software. Describe what you want — trim the footage, add background music, and export as a shareable video —...

Security Scan

The skill's behavior (uploading and rendering video on a cloud API) matches its description, but there are small inconsistencies and a few instructions that warrant caution before installing or using it.

Purpose & Capability

The skill's declared purpose (cloud video editing/export) matches the runtime instructions to call a remote rendering API and upload video files. Requiring a NEMO_TOKEN (and offering to obtain an anonymous token) is coherent for a cloud service. However, the package provenance is missing (no homepage, unknown source) and the SKILL.md frontmatter includes a config path (~/.config/nemovideo/) that is not listed in the registry metadata — an inconsistency worth questioning.

Instruction Scope

The SKILL.md instructs the agent to: look for NEMO_TOKEN in env, otherwise POST to an auth endpoint to obtain an anonymous token; create sessions, upload files (multipart or by URL), open SSE streams, poll render endpoints, and return download URLs. These actions are expected for a cloud render skill. Concerns: it suggests detecting the install path and setting an X-Skill-Platform header based on existence of ~/.clawhub or ~/.cursor/skills/, and the frontmatter references a config path (~/.config/nemovideo/) — both imply reading filesystem state beyond just the token and could reveal local environment structure. The instructions also say 'Don't expose tokens or raw API output' which is good, but there's broad discretion in mapping GUI actions to API calls (SSE and polling), so review network behavior before trusting with sensitive data.

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so it does not write files or install third-party packages. That is the lowest-risk install mechanism.

Credentials

Only one environment credential is declared (NEMO_TOKEN), which is proportionate for a cloud video service. The SKILL.md also declares a config path in its internal metadata (~/.config/nemovideo/) that could suggest reading files from that directory; the registry's top-level metadata did not list config paths. That mismatch should be clarified. The skill does not request unrelated credentials.

Persistence & Privilege

The skill is not marked always:true and is user-invocable; it does not request persistent or elevated platform privileges. Autonomous invocation (disable-model-invocation=false) is the platform default and not, by itself, a problem.

What to consider before installing

This skill appears to genuinely implement a cloud-based video editor: it uploads videos to https://mega-api-prod.nemovideo.ai, creates a session, and returns a downloadable MP4. Before installing or using it, consider the following: 1) You will be uploading your video files to an external service — do not upload sensitive or private footage without verifying the service's privacy policy and ownership. 2) The skill can obtain an anonymous token automatically; that reduces the need to supply a secret, but still results in remote processing of your data. 3) Ask the publisher for provenance (homepage, owner identity) and clarify the config-path discrepancy (~/.config/nemovideo/ appears in the SKILL.md but not the registry metadata). 4) If you want to avoid any local filesystem probing, ask whether the skill really needs to detect install paths (~/.clawhub or ~/.cursor) or access ~/.config/nemovideo/. 5) If you proceed, monitor network requests and review any returned URLs before clicking downloads. If the publisher cannot be verified or you need stronger assurances about data handling, do not install or use the skill.

Getting Started

Share your raw footage and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

• "create my raw footage"
• "export 1080p MP4"
• "trim the footage, add background music,"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Video Making — Create and Export Finished Videos

Send me your raw footage and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute phone recording of a product demo, type "trim the footage, add background music, and export as a shareable video", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter clips under 60 seconds process significantly faster.

Matching Input to Actions

User prompts referencing video making, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-making, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "trim the footage, add background music, and export as a shareable video" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the footage, add background music, and export as a shareable video" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.