Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Video Editor Cinematic

v1.0.0

Turn a 2-minute handheld travel clip into 4K cinematic edited videos just by typing what you need. Whether it's transforming raw footage into cinematic-style...

0· 63·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vcarolxhberger/ai-video-editor-cinematic.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ai Video Editor Cinematic" (vcarolxhberger/ai-video-editor-cinematic) from ClawHub.
Skill page: https://clawhub.ai/vcarolxhberger/ai-video-editor-cinematic
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ai-video-editor-cinematic

ClawHub CLI

Package manager switcher

npx clawhub@latest install ai-video-editor-cinematic
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the runtime instructions: the skill routes uploads and edit requests to a nemo video backend and performs cloud rendering. Requiring a NEMO_TOKEN and a ~/.config/nemovideo/ config location is consistent with a cloud service client. However there's an inconsistency: the registry summary shows 'Required config paths: none' while the SKILL.md frontmatter declares configPaths ['~/.config/nemovideo/']. Also SKILL.md both declares NEMO_TOKEN as primary credential and provides a fallback anonymous-token flow when NEMO_TOKEN is missing — so the manifest's 'required' claim is overstated.
Instruction Scope
The instructions stay within the stated purpose: they describe auth, session creation, SSE messaging, file uploads (multipart or URL), rendering, polling, and error handling against the nemo API. The skill explicitly instructs the agent to read local video files for upload and to store session_id/token values (likely under the stated config path). It does not instruct reading unrelated system files or unrelated credentials. It also instructs not to display raw API responses or tokens to the user.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk. Nothing in the manifest attempts to download or extract third-party code.
Credentials
Only one credential is requested (NEMO_TOKEN), which is proportional for a cloud video editing service. Caveat: the manifest declares NEMO_TOKEN required but SKILL.md will auto-generate an anonymous token if NEMO_TOKEN is not present. The skill also references a config path (in SKILL.md) that may be used to persist session/token information; that access was not listed in the top-level registry metadata, which is an inconsistency worth clarifying.
Persistence & Privilege
The skill does not request 'always: true' and uses normal autonomous invocation defaults. It will store session state/token and may write under ~/.config/nemovideo/ per SKILL.md metadata; this is reasonable for a client that resumes sessions, but you should confirm how/where tokens and session IDs are stored and for how long.
What to consider before installing
What to consider before installing: - Privacy and content: this skill uploads your raw videos to https://mega-api-prod.nemovideo.ai for cloud processing. If your footage contains sensitive content, do not use this skill unless you trust that service and its privacy policy. - Token handling: the skill expects a NEMO_TOKEN but will generate an anonymous token automatically if none is set; the skill will persist session/token data (SKILL.md references ~/.config/nemovideo/). Ask the author where tokens/session IDs are stored, how long they are retained, and whether they are encrypted. - Metadata mismatch: the registry metadata claimed no config paths, but SKILL.md lists a config path; the manifest also marks NEMO_TOKEN as required yet includes a fallback anonymous-token flow. These inconsistencies should be clarified by the publisher before you rely on the declared requirements. - Headers and attribution: the skill requires three custom headers on every request (X-Skill-Source/Version/Platform); the Platform header is to be auto-detected from an install path — confirm what path info will be read to form that header. If you need strict control over where tokens and video data go, request clarification from the skill author (token storage location/retention, exact upload endpoints, and a privacy/terms link). If you are comfortable with a third-party cloud render service and anonymous tokens, the skill's behavior is otherwise consistent with its purpose.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk972570hy87nhw6zy476bq4zbh85fgac
63downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

Getting Started

Share your raw video footage and I'll get started on AI cinematic editing. Or just tell me what you're thinking.

Try saying:

  • "transform my raw video footage"
  • "export 4K MP4"
  • "apply cinematic color grading, smooth transitions,"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

AI Video Editor Cinematic — Turn Raw Footage into Cinematic Videos

Drop your raw video footage in the chat and tell me what you need. I'll handle the AI cinematic editing on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 2-minute handheld travel clip, ask for apply cinematic color grading, smooth transitions, and dramatic pacing cuts, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 4K by default.

One thing worth knowing — shooting in flat or log color profile gives the AI more range to apply cinematic grading.

Matching Input to Actions

User prompts referencing ai video editor cinematic, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourceai-video-editor-cinematic
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "apply cinematic color grading, smooth transitions, and dramatic pacing cuts" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, ProRes for the smoothest experience.

Export as MP4 with H.264 codec for the best balance of cinematic quality and file size.

Common Workflows

Quick edit: Upload → "apply cinematic color grading, smooth transitions, and dramatic pacing cuts" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...