Youtube Subtitle

add YouTube video into captioned YouTube videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers use it for adding subtitles to Y...

Security Scan

The skill's declared purpose (adding subtitles via a cloud backend) matches its instructions and requested credential (NEMO_TOKEN); minor metadata inconsistencies and the fact that it uploads user videos to an external service are the main things to review before installing.

Purpose & Capability

The skill claims to generate and embed subtitles via a cloud GPU backend and only requests a single service token (NEMO_TOKEN), which is coherent. Minor inconsistency: the registry metadata stated no required config paths, but the SKILL.md frontmatter references a config path (~/.config/nemovideo/) and requires attribution headers — this is a small mismatch in metadata vs. instructions but does not contradict the stated purpose.

Instruction Scope

SKILL.md instructions are narrowly scoped to interacting with the nemovideo.ai backend: creating/using a session, uploading videos, polling render status, handling SSE. It does not instruct the agent to read unrelated local files or arbitrary environment variables beyond NEMO_TOKEN, nor to exfiltrate other system data. It does direct upload of user-provided videos to an external service, which is expected for the stated functionality.

Install Mechanism

There is no install spec and no code files — this is an instruction-only skill. That is the lowest-risk install mechanism; nothing is written to disk by an installer step as part of this skill package.

Credentials

Only NEMO_TOKEN is required (declared as primaryEnv), which is proportional to a cloud-rendering service. The skill also documents an anonymous-token acquisition flow (POST to /api/auth/anonymous-token) if NEMO_TOKEN is absent — that is reasonable. The frontmatter mentions a config path (~/.config/nemovideo/), implying it may persist the token or client id; the registry metadata did not list this path, so it's unclear whether tokens/ids are stored locally. Confirming storage behavior would clarify privacy implications.

Persistence & Privilege

always is false and the skill does not request unusual persistent privileges. Autonomous invocation is allowed (platform default) but there is no evidence this skill modifies other skills or system-wide settings. Potential persistence of an anonymous token in a config path is possible (per frontmatter) but not explicitly specified.

Assessment

This skill appears to do what it says: it uploads video files to a nemovideo.ai backend, creates a session, and returns rendered videos. Before installing or using it, consider: (1) Privacy — videos are sent to an external service (https://mega-api-prod.nemovideo.ai); do not upload sensitive or private footage unless you trust that service and its retention policy. (2) Token persistence — SKILL.md supports obtaining an anonymous NEMO_TOKEN and frontmatter references ~/.config/nemovideo/; ask or verify whether tokens or client IDs are stored locally and how to revoke them. (3) Metadata mismatch — registry metadata omitted the config path referenced in SKILL.md; confirm with the publisher or review runtime behavior if possible. (4) Attribution headers — the skill will include headers that identify the skill and platform; if that matters for anonymity, take note. (5) If you need higher assurance, request the skill’s source/homepage or code, or run the workflow in an isolated environment and monitor outbound requests. If any of these items are unacceptable (privacy, unknown storage, lack of publisher info), do not install or use the skill until clarified.

Getting Started

Share your YouTube video and I'll get started on subtitle generation. Or just tell me what you're thinking.

Try saying:

• "add my YouTube video"
• "export 1080p MP4"
• "add subtitles in English and Spanish"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

YouTube Subtitle — Generate and Embed Video Captions

Drop your YouTube video in the chat and tell me what you need. I'll handle the subtitle generation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 10-minute YouTube tutorial video, ask for add subtitles in English and Spanish to my YouTube video, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter video segments generate subtitles faster and with higher accuracy.

Matching Input to Actions

User prompts referencing youtube subtitle, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

Header	Value
X-Skill-Source	youtube-subtitle
X-Skill-Version	frontmatter version
X-Skill-Platform	auto-detect: clawhub / cursor / unknown from install path

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add subtitles in English and Spanish to my YouTube video" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility with YouTube uploads.

Common Workflows

Quick edit: Upload → "add subtitles in English and Spanish to my YouTube video" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.