Skyreels

Turn a landscape photo or a 10-second clip into 1080p cinematic sky videos just by typing what you need. Whether it's generating sky and aerial cinematic vid...

Security Scan

The skill's requests and runtime instructions generally match its description (cloud video generation using a NEMO_TOKEN), but there are a few small metadata/instructional inconsistencies and some vague guidance about token handling you should review before installing.

Purpose & Capability

Name/description, declared primaryEnv (NEMO_TOKEN), and the SKILL.md endpoints all point to the same cloud video service (nemovideo.ai). Requesting a service token and using remote GPU rendering endpoints is coherent with a cloud-based video generator. One inconsistency: the registry summary listed no required config paths, while the SKILL.md frontmatter includes a config path (~/.config/nemovideo/). This mismatch is minor but worth verifying.

Instruction Scope

SKILL.md instructs the agent to check NEMO_TOKEN, and if absent to generate a client UUID and POST to the anonymous-token endpoint to obtain an ephemeral token; it then creates sessions, uploads files, listens to SSE, polls render status, and returns download URLs — all consistent with the stated purpose. The instructions also tell the agent to detect install path to set an X-Skill-Platform header (implies reading filesystem/paths), and to store/use session_id and tokens; the skill does not specify secure storage semantics. These behaviors are expected for a cloud render skill but the token handling/storage and filesystem inspection are somewhat underspecified.

Install Mechanism

This is an instruction-only skill with no install spec or included code files, so nothing is written to disk by an installer. That is the lowest-risk install model.

Credentials

Only NEMO_TOKEN is requested as a required credential and the SKILL.md documents obtaining an anonymous token from the same service if missing. No unrelated credentials or broad environment access are requested. The ephemeral anonymous-token flow (100 free credits, 7-day expiry) matches the declared primary credential and is proportionate.

Persistence & Privilege

Skill is not always-enabled and normal autonomous invocation is allowed. It will create session tokens and may persist them for the session; SKILL.md references a local config path and install-path detection for header attribution, implying it may read certain paths. This is reasonable for attribution and session caching, but the instructions lack detail on where/how tokens are stored or how long they persist.

Assessment

This skill appears to do what it says: it uploads your images/clips to a nemovideo.ai backend, creates sessions, and returns a rendered MP4. Before installing: (1) Confirm you trust the nemovideo.ai domain — uploaded media and any generated tokens will be sent to that service. (2) Prefer using the anonymous token flow if you don't want to supply a long-lived NEMO_TOKEN; note anonymous tokens expire in ~7 days. (3) Be aware the skill may read install-related paths to set X-Skill-Platform headers and will hold session tokens for the job; ask the publisher where tokens are stored if you need persistence guarantees. (4) Do not supply other unrelated secrets. If you need higher assurance, request the publisher to clarify the config-path requirement and token storage behavior.

Getting Started

Send me your images or video clips and I'll handle the AI video generation. Or just describe what you're after.

Try saying:

• "generate a landscape photo or a 10-second clip into a 1080p MP4"
• "turn my photo into a cinematic sky timelapse video"
• "generating sky and aerial cinematic video clips from images for filmmakers, content creators, social media creators"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

SkyReels — Generate Cinematic Sky Videos

Send me your images or video clips and describe the result you want. The AI video generation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a landscape photo or a 10-second clip, type "turn my photo into a cinematic sky timelapse video", and you'll get a 1080p MP4 back in roughly 30-90 seconds. All rendering happens server-side.

Worth noting: high-contrast sky images produce the most dramatic results.

Matching Input to Actions

User prompts referencing skyreels, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is skyreels, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn my photo into a cinematic sky timelapse video" — concrete instructions get better results.

Max file size is 200MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across platforms and editors.

Common Workflows

Quick edit: Upload → "turn my photo into a cinematic sky timelapse video" → Download MP4. Takes 30-90 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.