Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Screen

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — crop the screen recording to 16:9, highlight the cursor clicks, and add a...

0· 74·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mory128/video-screen.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Screen" (mory128/video-screen) from ClawHub.
Skill page: https://clawhub.ai/mory128/video-screen
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-screen

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-screen
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the runtime actions: the SKILL.md instructs the agent to upload videos and call a nemovideo backend. Requesting a single NEMO_TOKEN credential is proportionate for a hosted video-editing service. However, the skill frontmatter metadata names a config path (~/.config/nemovideo/) while the registry summary said no required config paths — this discrepancy is unresolved.
!
Instruction Scope
The SKILL.md gives detailed, stepwise instructions to: use NEMO_TOKEN (or obtain an anonymous token via POST), create sessions, upload files, stream SSE responses, poll render status, and return download URLs. Those actions are consistent with the described service. Concerns: it instructs the agent to 'auto-detect' X-Skill-Platform from the install path (implies inspecting install/agent paths) and requires strict attribution headers matching frontmatter values — both could lead the agent to inspect local environment/paths or otherwise leak metadata. The doc also instructs hiding technical details from the user, which is fine operationally but worth noting.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. There is no remote code download or package install to review.
Credentials
Only one credential is declared (NEMO_TOKEN), which is appropriate for a hosted video-editing API. The SKILL.md will fallback to requesting an anonymous token from the nemovideo API if no token is present. Important: any real account NEMO_TOKEN you supply would grant the skill full bearer access to that account's API operations, so supplying a personal token has real privilege implications.
Persistence & Privilege
always:false and normal autonomous invocation are used (expected). The skill references a config path in its frontmatter and requests platform auto-detection from install paths — this implies potential local filesystem inspection for metadata, which is disproportionate for a pure runtime instruction set unless used solely to set a header. It does not request to modify other skills or system-wide settings.
What to consider before installing
This skill behaves like a thin client for a hosted service (nemovideo.ai) and will upload any video you give it to that backend for processing. Before installing or invoking it: (1) Do not provide a personal NEMO_TOKEN unless you trust the nemovideo service — a bearer token equals API access to your account; prefer letting the skill obtain an anonymous token if possible. (2) Confirm the privacy/retention policy for uploaded videos and whether returned download URLs are public. (3) Note the minor inconsistencies (claimed config path in the SKILL.md vs registry metadata) and the instruction to auto-detect platform from install path — ask the publisher to clarify whether the skill will inspect local paths or files. (4) Because this is instruction-only, there is no code to audit; only proceed if you trust the external domain (https://mega-api-prod.nemovideo.ai) and are comfortable with remote processing of your media. If you need higher confidence, request the publisher to reconcile the metadata and to document exactly what local files/paths (if any) the agent will read.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🖥️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk9778vkyvr4s12hr10zma2n3x985cjpz
74downloads
0stars
1versions
Updated 5d ago
v1.0.0
MIT-0

Getting Started

Ready when you are. Drop your video clips here or describe what you want to make.

Try saying:

  • "edit a 2-minute screen recording of a software walkthrough into a 1080p MP4"
  • "crop the screen recording to 16:9, highlight the cursor clicks, and add a voiceover track"
  • "editing screen recordings into shareable tutorial videos for educators, software developers, content creators"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Video Screen — Edit and Export Screen Recordings

Send me your video clips and describe the result you want. The screen capture editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute screen recording of a software walkthrough, type "crop the screen recording to 16:9, highlight the cursor clicks, and add a voiceover track", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: trim silent pauses at the start and end to keep viewers engaged from the first second.

Matching Input to Actions

User prompts referencing video screen, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcevideo-screen
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "crop the screen recording to 16:9, highlight the cursor clicks, and add a voiceover track" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "crop the screen recording to 16:9, highlight the cursor clicks, and add a voiceover track" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for the best balance of quality and file size.

Comments

Loading comments...