Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Editing Ideas Ai

v1.0.0

generate raw video footage into edited video concepts with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. content creators use it for generati...

0· 12·0 current·0 all-time
bypeandrover adam@peand-rover
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the instructions: the skill uploads video files and calls a cloud rendering API to return edited outputs. Requested credential (NEMO_TOKEN) is appropriate for an external rendering service. Minor inconsistency: the registry metadata reported no required config paths, but the SKILL.md YAML frontmatter includes configPaths ['~/.config/nemovideo/'], which suggests the skill may read or write a config directory that the registry did not declare.
!
Instruction Scope
At first-run the skill instructs the agent to automatically connect to an external API and, if no NEMO_TOKEN is present, to generate an anonymous token by POSTing to the service — this means network calls occur without an explicit user upload action. The skill also instructs deriving an X-Skill-Platform header by checking install paths (~/.clawhub, ~/.cursor/skills/), which implies the agent will probe the filesystem. The core actions (uploading files, polling render status, downloading output) are consistent with the stated purpose, but the automatic background auth and filesystem probing broaden the scope and are notable.
Install Mechanism
This is instruction-only with no install spec and no code files, so nothing will be written to disk by an installer. That is the lowest-risk install mechanism.
Credentials
Only one environment credential is declared (NEMO_TOKEN), which is proportional for a cloud API. However SKILL.md describes creating and using an anonymous token if NEMO_TOKEN is absent (and suggests storing session_id and using the token for subsequent requests). The YAML frontmatter's configPaths suggests possible additional on-disk config access even though the registry listed none — this mismatch should be clarified.
Persistence & Privilege
The skill is not marked always:true and uses normal autonomous invocation. It asks the agent to store a session_id and to persist or reuse an anonymous token for subsequent calls, which is reasonable for a session-based cloud API and does not request system-wide privileges or modify other skills.
What to consider before installing
This skill will upload your video files to an external service (mega-api-prod.nemovideo.ai) and will automatically request an anonymous token if you haven't provided NEMO_TOKEN — network requests can occur as soon as the skill is opened. Consider whether you are comfortable sending the specific videos you plan to use to that service. If you prefer explicit control, set NEMO_TOKEN yourself (from a trusted vendor page) rather than allowing automatic token creation, and avoid opening the skill until you're ready to upload. Ask the publisher to clarify the configPath behavior (the SKILL.md frontmatter lists ~/.config/nemovideo/ but the registry did not) and whether the agent will probe your ~/.clawhub or ~/.cursor directories to derive headers. If you handle sensitive footage, test with non-sensitive clips first or avoid installing until these points are clarified.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97030b65mdyjh1khywnjwgr6s85azg6
12downloads
0stars
1versions
Updated 5h ago
v1.0.0
MIT-0

Getting Started

Share your raw video footage and I'll get started on AI-powered idea generation. Or just tell me what you're thinking.

Try saying:

  • "generate my raw video footage"
  • "export 1080p MP4"
  • "suggest 5 creative ways to cut"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Video Editing Ideas AI — Generate AI Video Editing Concepts

This tool takes your raw video footage and runs AI-powered idea generation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 3-minute unedited vlog recording and want to suggest 5 creative ways to cut and style this footage for YouTube — the backend processes it in about 20-40 seconds and hands you a 1080p MP4.

Tip: shorter clips under 2 minutes get more focused and actionable editing suggestions.

Matching Input to Actions

User prompts referencing video editing ideas ai, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-editing-ideas-ai, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "suggest 5 creative ways to cut and style this footage for YouTube" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.

Common Workflows

Quick edit: Upload → "suggest 5 creative ways to cut and style this footage for YouTube" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...