Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Vidnoz Ai Music Video Generator

v1.0.0

Turn raw clips and audio tracks into polished, beat-synced music videos without manual editing. The vidnoz-ai-music-video-generator skill automates scene tra...

0· 62·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description align with the runtime actions: cloud beat-syncing, uploading media, creating sessions, and exporting renders. Requesting a single service token (NEMO_TOKEN) and enabling file uploads is proportionate for a video-processing API. However, SKILL.md frontmatter lists a config path (~/.config/nemovideo/) and tests install-paths to set X-Skill-Platform while the registry metadata provided earlier said no required config paths and there is no install spec — this mismatch is inconsistent and could lead to unexpected file reads if implemented.
!
Instruction Scope
The instructions explicitly perform network calls to mega-api-prod.nemovideo.ai (auth/anonymous-token, session creation, SSE, uploads, exports) and require uploading local files (multipart file=@/path) or URLs. Uploading local files is reasonable for a media tool, but the SKILL.md does not state where/how session_id or the anonymous token are persisted (it implies setting NEMO_TOKEN). The file-upload guidance and automatic anonymous-token flow mean the agent will read local file paths and transmit user media and tokens to an external service — users should understand and consent to that. The install-path detection logic in the skill attribution section is odd for an instruction-only skill and may cause the agent to probe filesystem paths.
Install Mechanism
There is no install spec and no code files; this is instruction-only. That minimizes on-disk code installation risk, but runtime network activity (HTTP requests, SSE) and local file reads still occur per the instructions.
Credentials
Only one credential (NEMO_TOKEN) is declared as required, which fits the described API usage. The skill's frontmatter also lists a config path (~/.config/nemovideo/), which was not declared in the registry summary — this inconsistency raises questions about whether the skill expects to read configuration files beyond the single token. The anonymous-token generation flow will create and rely on a token but the instructions are vague about secure storage/rotation.
Persistence & Privilege
always:false and no install actions are present. The skill does not request elevated persistence. Note that autonomous invocation (disable-model-invocation:false) is the platform default; combined with network/file access this increases the blast radius but is not by itself a misconfiguration.
What to consider before installing
This skill appears to implement a normal cloud-based media-processing workflow (you supply clips, it uploads them to nemovideo.ai with a bearer token and returns rendered videos). Before installing/using it: - Verify the service provenance: there is no homepage or source URL in the metadata. Confirm you trust mega-api-prod.nemovideo.ai and the publisher before sending media. - Expect the agent to read local file paths you provide and upload those files to the external API. Do not upload sensitive or private footage unless you’re comfortable with the service’s retention and privacy policies. - The skill can create an anonymous token and use it as NEMO_TOKEN. Ask how/where that token and session_id are stored; prefer ephemeral/anonymous tokens and revoke them when done. - The SKILL.md contains a small metadata inconsistency (config path and install-path detection despite being instruction-only). Ask the publisher to clarify whether the skill will read ~/.config/nemovideo/ or probe install paths. - If you proceed, consider running with an isolated account or ephemeral credentials and review network activity/logs so you can confirm what was transmitted.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk970tbyzaydse11p7x4fvx9vf584f2q4
62downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Welcome! You've got footage and a track — let's turn them into something worth sharing. Tell me what you're working with and I'll help you build a beat-synced music video using Vidnoz AI right now.

Try saying:

  • "Sync my clips to this track"
  • "Create a 30-second music reel"
  • "Match cuts to beat drops"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Create Beat-Synced Music Videos in Minutes

Making a music video used to mean hours in a timeline editor, manually cutting clips to match every beat drop and melody shift. The Vidnoz AI Music Video Generator changes that entirely. By analyzing both your footage and your audio track simultaneously, it identifies rhythm patterns, tempo changes, and emotional peaks — then assembles your clips to match them naturally.

This skill gives you direct access to that automation layer. You can describe the style you want, specify the mood, select transition types, or let the AI make creative decisions based on your source material. Whether you're producing a lyric video, a brand reel, a wedding highlight, or a social media clip, the output is timed, coherent, and visually engaging.

The tool is designed for people who want quality results without needing professional editing experience. You bring the footage and the song — the AI brings the timing, the cuts, and the visual flow. It's a practical shortcut from raw media to shareable video.

Routing Clips and Beat Requests

When you submit a footage upload or music sync request, ClawHub parses your intent and routes it to the appropriate Vidnoz AI pipeline — whether that's beat detection, auto-cut sequencing, or transition styling.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Vidnoz Cloud Processing Reference

Vidnoz AI handles all music-to-video synchronization server-side, using its beat-matching engine to analyze BPM, waveform peaks, and rhythm patterns before applying automated cuts and transitions to your footage. Your rendered music video is processed entirely in the cloud, so local hardware specs have no impact on export quality or sync accuracy.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: vidnoz-ai-music-video-generator
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Performance Notes

The vidnoz-ai-music-video-generator performs best when your audio track has a clear, consistent tempo or identifiable beat markers. Songs with strong percussion or defined drops give the AI more anchor points for cut alignment, resulting in tighter sync.

For footage, shorter clips (3–10 seconds each) tend to produce more dynamic results than long uncut takes. The more variety in your source material — different angles, movement speeds, and lighting — the more visually interesting the final edit will be.

If you're working with a track that has a slow tempo or ambient structure, specify a 'mood-based' rather than 'beat-based' sync mode. This tells the AI to prioritize emotional pacing over strict rhythmic cuts, which suits cinematic and documentary-style videos far better.

Common Workflows

Most users approach the vidnoz-ai-music-video-generator with one of three workflows. The first is the full-auto approach: upload footage and audio, let the AI select clip order, transition style, and beat alignment without manual input. This works well for social content where speed matters more than precise creative control.

The second workflow is style-guided generation. Here you describe a visual mood — cinematic, energetic, minimal, nostalgic — and the AI applies matching effects, color treatment, and cut pacing to your material. This is popular for brand videos and music artist content.

The third workflow is segment-specific editing: you lock certain scenes to specific timestamps in the song and let the AI fill the gaps. This gives you creative checkpoints while still automating the bulk of the assembly. It's the preferred method for wedding films and narrative-driven reels where specific moments must hit on cue.

Use Cases

The vidnoz-ai-music-video-generator fits a wide range of real-world content needs. Musicians and bands use it to produce lyric videos and visual albums without hiring a video editor. The AI handles the timing and aesthetics while the artist focuses on the creative direction.

Social media managers use it to turn product footage into scroll-stopping reels timed to trending audio, dramatically cutting production time per post. E-commerce brands find it especially useful for seasonal campaigns where multiple product videos need to be produced quickly.

Event videographers — particularly in weddings and corporate productions — rely on it to deliver highlight reels the same day as the event. And independent content creators on YouTube and TikTok use it to add a professional polish to vlogs and travel content without investing in expensive software or editing skills.

Comments

Loading comments...