Ai Tool For Video Creation

Skip the learning curve of professional editing software. Describe what you want — combine these images and audio into a 30-second promotional video with tex...

Security Scan

The skill's declared purpose (cloud video creation) matches most of its instructions (calls to a nemo video API), but there are metadata inconsistencies and vague handling of credentials/session state that merit caution before installing.

Purpose & Capability

The skill's name/description align with making network calls to a video-rendering backend and requiring a NEMO_TOKEN. That credential and the listed API endpoints are coherent with a cloud video service. However, the SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata provided to you listed no required config paths — this mismatch is unexplained.

Instruction Scope

Runtime instructions direct the agent to obtain an anonymous token automatically if NEMO_TOKEN is not present, create sessions, upload user media, and poll render status — all expected for the stated purpose. But the SKILL.md also tells the agent not to display raw API responses or token values to the user and says to “store the returned session_id” without specifying where or whether that storage is transient. That opacity about token/session handling increases risk (tokens could be persisted, hidden, or reused without user visibility).

Install Mechanism

This is an instruction-only skill with no install spec and no code files, so nothing will be written to disk by an install step. That lowers install-time risk.

Credentials

The only declared required environment variable is NEMO_TOKEN, which is proportionate for a service that requires an API token. However, SKILL.md frontmatter also references a config path (~/.config/nemovideo/) that could contain credentials/config; the registry metadata shown to you did not declare this path. That discrepancy means the skill might expect or try to read local config without declaring it.

Persistence & Privilege

The skill is not marked always:true and has no install hooks, so it does not request elevated persistent presence. It does instruct keeping and reusing session_id tokens for the session lifecycle, which is normal, but where/how that data is stored is not specified.

What to consider before installing

This skill appears to be a front-end for an external video-rendering service (mega-api-prod.nemovideo.ai) and will upload media and use an API token. Before installing or using it, consider the following: (1) Confirm you trust the external domain (nemovideo.ai) because your media and generated tokens will be sent there. (2) Ask the skill author where session_id and any generated anonymous tokens are stored (in-memory only vs written to ~/.config or other files). The SKILL.md tells the agent to hide token values from users — ask for a transparent persistence policy. (3) If you have sensitive media, avoid automatic anonymous-token creation; prefer providing your own NEMO_TOKEN or verifying data retention policies. (4) The frontmatter references a local config path (~/.config/nemovideo/) but the registry metadata did not — request clarification or deny filesystem access. If you need stronger assurance, request the developer to (a) remove implicit token storage, (b) document exactly what is written to disk (if anything), and (c) provide a privacy/data-retention statement for uploaded media.

Getting Started

Share your images or clips and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

• "create my images or clips"
• "export 1080p MP4"
• "combine these images and audio into"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

AI Tool for Video Creation — Create and Export Videos with AI

This tool takes your images or clips and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have five product photos and a voiceover MP3 and want to combine these images and audio into a 30-second promotional video with text overlays — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: using fewer than 10 images speeds up generation noticeably.

Matching Input to Actions

User prompts referencing ai tool for video creation, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

Header	Value
X-Skill-Source	ai-tool-for-video-creation
X-Skill-Version	frontmatter version
X-Skill-Platform	auto-detect: clawhub / cursor / unknown from install path

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "combine these images and audio into a 30-second promotional video with text overlays" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "combine these images and audio into a 30-second promotional video with text overlays" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.