Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Editing With Google

v1.0.0

Turn a 2-minute screen recording from Google Meet into 1080p edited MP4 clips just by typing what you need. Whether it's editing and polishing videos to shar...

0· 24·0 current·0 all-time
bypeandrover adam@peand-rover
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The display name and description imply tight integration with Google (Google Meet, Drive, YouTube), but all runtime instructions call out a third‑party service (mega-api-prod.nemovideo.ai). Requesting only NEMO_TOKEN is consistent with that backend, but the 'with Google' branding is misleading and could cause users to assume Google handles processing when it does not.
Instruction Scope
SKILL.md instructs the agent to automatically obtain an anonymous token if NEMO_TOKEN is absent, create sessions, upload user video files, stream SSE chat, poll renders, and store a session_id/token for subsequent calls. These actions are within the scope of cloud video editing, but automatic token creation, persistent storage, and automatic uploads without an explicit consent prompt are potentially surprising and worth user attention.
Install Mechanism
This is instruction-only with no install spec and no code files — low installation risk. Nothing is downloaded or written by an installer step, though the skill does expect to write/read config under ~/.config/nemovideo/ per its metadata.
Credentials
Only a single env var (NEMO_TOKEN) is required, which matches the nemovideo backend. However, the instructions also use and may write to a config path (~/.config/nemovideo/) and will create a token if none exists. The skill also instructs adding attribution headers that reveal local install path info — minor privacy leakage but not necessary for core editing functionality.
Persistence & Privilege
always:false and user-invocable:true (normal). The skill will persist an anonymous token and session_id for up to 7 days and can orphan render jobs if the UI is closed. This is expected for a cloud render pipeline but is a persistence behavior users should be aware of.
What to consider before installing
This skill will upload your video files to a third‑party service (nemovideo.ai) — it is not running on Google servers despite the name. It will auto‑create an anonymous NEMO_TOKEN and store session state (token valid ~7 days) unless you supply your own NEMO_TOKEN. Before installing, confirm you are comfortable with: (1) your videos being sent to an external service, (2) an anonymous token being generated and stored under ~/.config/nemovideo/ or similar, and (3) the skill sending headers that may include install-path metadata. If the videos contain sensitive information, do not use this skill. If you proceed, consider supplying an explicit token you control, ask the vendor/site (nemovideo.ai) for their privacy/retention policy, and verify how to delete stored tokens/sessions and rendered files.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk975n0bgjspt64ntzf2ptnxzjs8588kr
24downloads
0stars
1versions
Updated 9h ago
v1.0.0
MIT-0

Getting Started

Share your video clips and I'll get started on AI video editing. Or just tell me what you're thinking.

Try saying:

  • "edit my video clips"
  • "export 1080p MP4"
  • "trim pauses, add captions, and export"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Video Editing with Google — Edit and Export Videos for Google

This tool takes your video clips and runs AI video editing through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 2-minute screen recording from Google Meet and want to trim pauses, add captions, and export for Google Drive sharing — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: shorter clips under 3 minutes process significantly faster.

Matching Input to Actions

User prompts referencing video editing with google, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-editing-with-google, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Common Workflows

Quick edit: Upload → "trim pauses, add captions, and export for Google Drive sharing" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim pauses, add captions, and export for Google Drive sharing" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, WebM, AVI for the smoothest experience.

Export as MP4 for widest compatibility with Google Drive, Slides, and YouTube.

Comments

Loading comments...