Ai Video Editor Highlights

Get highlight reel clips ready to post, without touching a single slider. Upload your raw video footage (MP4, MOV, AVI, WebM, up to 500MB), say something lik...

Security Scan

The skill mostly does what it claims (upload footage to a remote AI render service), but there are inconsistencies around required credentials and declared config access that don't add up and deserve caution.

Purpose & Capability

The skill's name and description match the runtime instructions: it uploads user videos to a remote API and returns rendered highlights. Requesting network access and a bearer token is consistent with that purpose. However, the registry metadata marks NEMO_TOKEN as a required primary credential while the SKILL.md provides an anonymous-token fallback flow — this is inconsistent.

Instruction Scope

Instructions are explicit about API endpoints, session creation, uploads, SSE handling, and export polling — all relevant to a remote video-editing service. They instruct creating a UUID, POSTing to auth and session endpoints, and uploading user files. The only scope concern is the requirement to auto-detect an "install path" to set X-Skill-Platform and the metadata's configPaths (~/.config/nemovideo/) — the doc doesn't show any legitimate need to read local config paths or the filesystem, so that is unclear.

Install Mechanism

Instruction-only skill with no install spec and no code files: nothing is written to disk by the skill itself. This is the lowest install risk.

Credentials

The only declared env var is NEMO_TOKEN, which is reasonable for an API-backed service. However, the SKILL.md itself supports getting an anonymous token if NEMO_TOKEN is absent, so marking NEMO_TOKEN as "required" in metadata is disproportionate. Additionally, the metadata declares a config path (~/.config/nemovideo/) but the instructions never explain reading it — requesting access to a user config path without justification is suspicious.

Persistence & Privilege

always:false and no install steps. The skill does not request permanent inclusion or system-wide changes. It will cause uploads of user video to a remote service (expected for function) but does not request elevated agent privileges.

What to consider before installing

This skill appears to implement a cloud-based video highlight pipeline and will upload any videos you give it to https://mega-api-prod.nemovideo.ai for server-side processing. Before installing or using it: (1) Ask the publisher why NEMO_TOKEN is marked as required when the instructions describe an anonymous-token fallback — prefer anonymous tokens if you do not want a persistent credential stored in your environment. (2) Ask why the metadata lists a local config path (~/.config/nemovideo/) and whether the skill will read local files; do not grant or place credentials/configs there unless you trust the vendor. (3) Understand privacy/retention policies for uploaded videos and who can access them (retention time, sharing, processing). (4) Confirm the exact header/attribution behavior and whether any agent filesystem reads (install-path detection) are performed — if you want to avoid local filesystem access, require the vendor to remove install-path auto-detection. If the author provides code, a clear privacy policy, or removes the unexplained config-path requirement, my confidence would increase and the rating could change to benign.

Getting Started

Share your raw video footage and I'll get started on AI highlight extraction. Or just tell me what you're thinking.

Try saying:

• "generate my raw video footage"
• "export 1080p MP4"
• "extract the best moments and compile"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

• Generate a UUID as client identifier
• POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
• The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

AI Video Editor Highlights — Extract and Export Video Highlights

Send me your raw video footage and describe the result you want. The AI highlight extraction runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 90-minute sports game recording, type "extract the best moments and compile them into a 2-minute highlight reel", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: uploading footage with clear audio cues helps the AI detect highlights more accurately.

Matching Input to Actions

User prompts referencing ai video editor highlights, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

Header	Value
X-Skill-Source	ai-video-editor-highlights
X-Skill-Version	frontmatter version
X-Skill-Platform	auto-detect: clawhub / cursor / unknown from install path

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

Common Workflows

Quick edit: Upload → "extract the best moments and compile them into a 2-minute highlight reel" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "extract the best moments and compile them into a 2-minute highlight reel" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across social platforms.