Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Dubbing Ffmpeg Video

v1.0.0

Get dubbed video files ready to post, without touching a single slider. Upload your video files (MP4, MOV, AVI, MKV, up to 500MB), say something like "replac...

0· 28·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to do cloud-based FFmpeg dubbing (so it does not need a local ffmpeg binary), and it requests a NEMO_TOKEN which is coherent. However the SKILL.md metadata lists a required config path (~/.config/nemovideo/) while the registry summary earlier showed no required config paths — this mismatch should be reconciled. The use of 'FFmpeg' in the name might imply local processing to some users, but the instructions consistently describe a cloud backend.
!
Instruction Scope
Runtime instructions explicitly read the NEMO_TOKEN env var (if present), otherwise generate an anonymous token by POSTing to https://mega-api-prod.nemovideo.ai and then upload user video files and poll for render results. Uploading user videos to a third‑party endpoint is central to the skill but is a privacy risk: the SKILL.md does not describe data retention, sharing, or consent flows. The skill also inspects install paths to set an X-Skill-Platform header (reads path strings), which is a benign metadata read but should be noted.
Install Mechanism
Instruction-only skill with no install spec and no code files — nothing is written to disk by an installer. This is the lowest-risk install mechanism. There is no downloadable archive or external package to inspect.
Credentials
The only declared credential is NEMO_TOKEN (primaryEnv), which is proportional given the cloud API. The SKILL.md will attempt to mint an anonymous NEMO_TOKEN if none is present, which is expected but means the skill may obtain and use tokens without the user providing one. There is an inconsistency between the top-level registry data (no required config paths) and the SKILL.md metadata (lists ~/.config/nemovideo/).
Persistence & Privilege
always:false (no forced inclusion) and the skill does not request elevated privileges or persistent system modifications. It keeps an in-session session_id for operations but does not instruct writing other skills' configs or system-wide settings. Autonomous invocation is allowed (default) — combine that consideration with the privacy concerns above.
What to consider before installing
This skill uploads your videos to a third-party service (mega-api-prod.nemovideo.ai) and will either use a NEMO_TOKEN you provide or create an anonymous token for you. Before installing: 1) Confirm you trust nemovideo.ai and are comfortable uploading the kinds of videos you will provide (no sensitive/personal data). 2) Ask the publisher or provider for a privacy/retention policy and for details on where tokens and session IDs are stored and whether uploads are retained or shared. 3) Note the small metadata inconsistency (config path listed in SKILL.md but not in registry); ask the author to clarify what local config, if any, the skill will read or write. 4) If you have your own NEMO_TOKEN/account, prefer supplying it rather than relying on anonymous token creation. If any of these answers are unsatisfactory, treat the skill as risky and avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎙️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk9759070nj2468cpaycbmnc2dh852mw1
28downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

Getting Started

Share your video files and I'll get started on AI audio dubbing. Or just tell me what you're thinking.

Try saying:

  • "add my video files"
  • "export 1080p MP4"
  • "replace the original audio with a"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

  • Generate a UUID as client identifier
  • POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
  • Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Dubbing FFmpeg Video — Dub and Export Videos Fast

This tool takes your video files and runs AI audio dubbing through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 3-minute MP4 interview video and want to replace the original audio with a dubbed Spanish voiceover using FFmpeg — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: shorter clips under 5 minutes process significantly faster and reduce sync errors.

Matching Input to Actions

User prompts referencing dubbing ffmpeg video, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is dubbing-ffmpeg-video, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "replace the original audio with a dubbed Spanish voiceover using FFmpeg" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "replace the original audio with a dubbed Spanish voiceover using FFmpeg" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, MKV for the smoothest experience.

H.264 codec gives the best balance of quality and file size for dubbed MP4 output.

Comments

Loading comments...