Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Video Generation Online

v1.0.0

generate text or images into AI generated videos with this skill. Works with MP4, MOV, JPG, PNG files up to 200MB. marketers, content creators, small busines...

0· 24·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (generate videos from text/images) matches the runtime instructions: calls a remote API, uploads files, creates render jobs and returns download URLs. Requesting a single API token (NEMO_TOKEN) is appropriate for this purpose.
Instruction Scope
Instructions are detailed and remain within the stated purpose (auth, session creation, SSE message streaming, upload, render/export polling). However the SKILL.md asks to 'auto-detect' an install path to set X-Skill-Platform and the frontmatter references a config path (~/.config/nemovideo/). That suggests the agent may inspect filesystem paths or environment to populate headers/config — an action not strictly needed to call the API and not declared consistently elsewhere. Also the instructions make it explicit that user files will be uploaded to a third‑party API, so privacy of uploaded content is an important consideration.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing will be downloaded or written to disk by an installer. That minimizes supply‑chain risk.
Credentials
The only declared required credential is NEMO_TOKEN (primaryEnv), which is proportional for an API client. Two small issues: (1) the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) that is not listed in the registry 'Required config paths' field — inconsistent declarations; (2) if NEMO_TOKEN is absent the skill instructs generating and exchanging an anonymous client UUID to obtain a token — this is expected behavior but it still sends a client identifier to a third‑party endpoint. No other unrelated secrets are requested.
Persistence & Privilege
always:false and no install script means the skill is not forcing permanent inclusion or elevated platform privileges. It does not request to modify other skills or system settings.
What to consider before installing
Things to consider before installing or using this skill: - It uploads your text, images, and any files you give it to a third‑party service at mega-api-prod.nemovideo.ai. Do not send private or sensitive content unless you trust that service and its privacy/terms. - The skill will use NEMO_TOKEN if present (store it in your environment if you want to use your account). If you don't provide one it will obtain an anonymous 7‑day token by POSTing a generated client UUID — this still tells the service about your agent's client id. - The SKILL.md references a local config path (~/.config/nemovideo/) and asks to auto-detect an install path for headers. Confirm whether the skill will actually read local files/configs; if you don't want any local inspection, don't provide environment tokens or files. - The skill comes from an unknown source and has no homepage. If you plan to use it frequently or for sensitive content, ask the publisher for: an official homepage/terms/privacy policy, a stable API owner identity, and a clear explanation of what (if anything) the agent will read from your filesystem. - If you proceed, prefer creating a limited account/token with the service (rather than using broader credentials) and avoid uploading confidential material. Monitor network activity and tokens for unexpected use. If you want, I can: (a) extract the exact API calls and headers the skill will make so you can review them, or (b) suggest a safer workflow (local rendering or a vetted provider) depending on your risk tolerance.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk974vfg9rrt01v7rs5ex9s1a4x855ase
24downloads
0stars
1versions
Updated 11h ago
v1.0.0
MIT-0

Getting Started

Send me your text or images and I'll handle the AI video creation. Or just describe what you're after.

Try saying:

  • "generate a short text script or three product images into a 1080p MP4"
  • "generate a 30-second promotional video from this product description"
  • "generating videos from text prompts or images without filming anything for marketers, content creators, small business owners"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

AI Video Generation Online — Generate Videos from Text or Images

Send me your text or images and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a short text script or three product images, type "generate a 30-second promotional video from this product description", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter, specific prompts tend to produce more accurate and usable video results.

Matching Input to Actions

User prompts referencing ai video generation online, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourceai-video-generation-online
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "generate a 30-second promotional video from this product description" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a 30-second promotional video from this product description" — concrete instructions get better results.

Max file size is 200MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across social platforms and websites.

Comments

Loading comments...