Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Maker Free Download App

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — combine these clips into a 60-second video with transitions and text overl...

0· 110·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mhogan2013-9/video-maker-free-download-app.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Maker Free Download App" (mhogan2013-9/video-maker-free-download-app) from ClawHub.
Skill page: https://clawhub.ai/mhogan2013-9/video-maker-free-download-app
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install mhogan2013-9/video-maker-free-download-app

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-maker-free-download-app
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (cloud video creation and export) matches the actions described (upload media, create a session, render, return download URL). Requesting a service token (NEMO_TOKEN) is reasonable. However, the registry metadata claims no required config paths while the SKILL.md frontmatter lists a config path (~/.config/nemovideo/)—this mismatch is unexplained and unexpected.
!
Instruction Scope
SKILL.md instructs the agent to: use NEMO_TOKEN if present, otherwise obtain an anonymous token by POSTing to https://mega-api-prod.nemovideo.ai, create sessions, upload user files, and perform SSE interactions. Those network calls are coherent with the skill's purpose, but the instructions also say to 'auto-detect' an install path for X-Skill-Platform attribution (which implies the agent may inspect its environment/install path) and to keep technical details out of the chat (reduces transparency). The skill will upload user media to an external domain and require attribution headers; these behaviors are within scope but the install-path auto-detection and undisclosed configPath are vague and grant extra agent discretion.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk at install time. That is the lowest-risk install mechanism.
!
Credentials
The skill declares a single primary credential (NEMO_TOKEN), which is proportionate. But the registry metadata marks NEMO_TOKEN as required while SKILL.md treats it as optional (it will request an anonymous token if missing). Also SKILL.md references a config path (~/.config/nemovideo/) that the registry metadata did not list. These inconsistencies (required vs optional credential, undeclared config path) are unexpected and reduce trust.
Persistence & Privilege
always:false and no install-time persistence are set. The skill does not request special system privileges or modify other skills' configurations in its instructions.
What to consider before installing
What to consider before installing: - The skill concept is coherent: it uploads media to a cloud renderer and returns a download link. Asking for a service token (NEMO_TOKEN) is expected. - Inconsistencies to watch: the registry metadata asserts no config paths and a required env var, but the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) and the text makes NEMO_TOKEN optional (the skill will obtain an anonymous token if none is present). Ask the publisher to clarify whether NEMO_TOKEN is truly required and why a config path is listed. - Privacy/security: using the skill will upload whatever files you give it to https://mega-api-prod.nemovideo.ai. Don’t send sensitive or private videos unless you trust that domain/operator and you’ve reviewed their privacy/retention policy. - Attribution headers: the skill requires special headers (including an X-Skill-Platform value derived from an install path). That could cause the agent to inspect its environment or reveal installation context — ask the author to confirm exactly how X-Skill-Platform is derived and whether it will read local paths. - If you want to test safely: try with non-sensitive, low-value media and monitor network requests; prefer providing your own NEMO_TOKEN (if you can get one) rather than letting the skill obtain anonymous tokens automatically. - Additional useful info to request from the publisher: an official homepage or privacy policy, who operates mega-api-prod.nemovideo.ai, token scope and lifetime docs, and confirmation of whether the listed config path is actually used. Without that, proceed with caution.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97cpcyp2vqhkr4xspcxbaj5a9854xfg
110downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Got video clips or images to work with? Send it over and tell me what you need — I'll take care of the AI video creation.

Try saying:

  • "create five product photos and a background music file into a 1080p MP4"
  • "combine these clips into a 60-second video with transitions and text overlays"
  • "creating shareable videos from photos and clips without installing software for casual creators and students"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Video Maker Free Download App — Create and Export Videos Online

Drop your video clips or images in the chat and tell me what you need. I'll handle the AI video creation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a five product photos and a background music file, ask for combine these clips into a 60-second video with transitions and text overlays, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — using shorter clips under 30 seconds each speeds up the final render noticeably.

Matching Input to Actions

User prompts referencing video maker free download app, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcevideo-maker-free-download-app
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "combine these clips into a 60-second video with transitions and text overlays" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across phones, social platforms, and desktop players.

Common Workflows

Quick edit: Upload → "combine these clips into a 60-second video with transitions and text overlays" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...