Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Editor Free Download

v1.0.0

Turn a 2-minute unedited screen recording into 1080p edited MP4 files just by typing what you need. Whether it's editing videos online without downloading so...

0· 51·0 current·0 all-time
bypeandrover adam@peand-rover
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The declared purpose (remote AI video editing, server-side rendering, returning download URLs) matches the endpoints, upload/render flows, and required Authorization header described in SKILL.md. Requesting an API token (NEMO_TOKEN) is appropriate for such a service.
Instruction Scope
Runtime instructions are focused on connecting to the remote editing backend, uploading files, streaming SSE, polling render status, and returning download URLs — all consistent with the stated purpose. They do not instruct reading unrelated system files or other secrets. However, the SKILL.md frontmatter references a config path (~/.config/nemovideo/) which the rest of the instructions never use; that metadata entry is inconsistent with the registry's 'required config paths: none' and may indicate sloppy authoring or unclear expectations about reading/writing local config.
Install Mechanism
Instruction-only skill with no install spec and no code files means nothing is written to disk by an installer. This minimizes supply-chain risk compared with arbitrary downloads.
Credentials
The skill requires a single credential (NEMO_TOKEN), which is proportional to its purpose. But it's inconsistent about that credential: SKILL.md declares NEMO_TOKEN required yet contains a full flow to auto-generate an anonymous token if NEMO_TOKEN is not set. That design is explainable but should be explicit to users: the agent will obtain and use tokens on behalf of users. No other unrelated credentials are requested.
Persistence & Privilege
The skill does not request always:true or other elevated platform privileges and does not instruct modifications to other skills or system-wide settings. It does instruct the agent to store a session_id and to reuse tokens for requests, which is normal for a session-based API.
What to consider before installing
This skill will upload your raw videos and other media to an external service (mega-api-prod.nemovideo.ai) for server-side editing — that's expected for an online editor but means your media leaves your machine. Consider: 1) Do you trust this unknown service and its data-retention/privacy policies? There's no homepage or provenance provided. 2) The skill will auto-create an anonymous NEMO_TOKEN if none is supplied; if you need control over tokens or auditability, supply your own token or refuse anonymous auth. 3) The SKILL.md frontmatter references a local config path (~/.config/nemovideo/) but the registry metadata says none — ask the author whether the skill will read/write local config files. 4) If you must keep media private, avoid using this skill or verify the service’s privacy/retention terms and test with non-sensitive content first. If you want to proceed, request the service's official homepage, privacy policy, and developer identity before uploading sensitive videos.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

✂️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97f841xd8bxyqg9wmb28p6x818569r9
51downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

Getting Started

Share your raw video clips and I'll get started on AI video editing. Or just tell me what you're thinking.

Try saying:

  • "edit my raw video clips"
  • "export 1080p MP4"
  • "trim the pauses, add transitions, and"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Editor Free Download — Edit Videos Online, No Download

Send me your raw video clips and describe the result you want. The AI video editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute unedited screen recording, type "trim the pauses, add transitions, and export a clean final cut", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter clips under 3 minutes process significantly faster in the browser.

Matching Input to Actions

User prompts referencing editor free download, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

EndpointMethodPurpose
/api/tasks/me/with-session/nemo_agentPOSTStart a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_ssePOSTSend a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>POSTUpload a file (multipart) or URL.
/api/credits/balance/simpleGETCheck remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latestGETFetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambdaPOSTStart export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourceeditor-free-download
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the pauses, add transitions, and export a clean final cut" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.

Common Workflows

Quick edit: Upload → "trim the pauses, add transitions, and export a clean final cut" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...