Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Video Subtitle Generator

v1.0.0

add video files into captioned video files with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers and content creators use it for addin...

0· 38·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vcarolxhberger/ai-video-subtitle-generator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ai Video Subtitle Generator" (vcarolxhberger/ai-video-subtitle-generator) from ClawHub.
Skill page: https://clawhub.ai/vcarolxhberger/ai-video-subtitle-generator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ai-video-subtitle-generator

ClawHub CLI

Package manager switcher

npx clawhub@latest install ai-video-subtitle-generator
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
The skill's stated purpose (generate and embed subtitles via a cloud backend) aligns with the only required credential (NEMO_TOKEN) and the API endpoints documented in SKILL.md. Asking for an API token or falling back to an anonymous token flow is consistent with a hosted subtitle/render service.
Instruction Scope
The runtime instructions explicitly tell the agent to upload user video files and stream SSE messages to the nemovideo.ai backend, and to exchange anonymous tokens when NEMO_TOKEN is absent — that is expected. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) and the text instructs detecting install path to set X-Skill-Platform; the registry metadata reported no required config paths. That metadata mismatch is inconsistent and worth clarifying. Also note: the agent will send user media to an external service (privacy implication).
Install Mechanism
No install spec and no code files — this is an instruction-only skill. That minimizes local disk writes and is low install risk.
Credentials
Only NEMO_TOKEN is declared as required (primaryEnv). The SKILL.md also documents an anonymous-token fallback via the public API when no token is present. No unrelated credentials are requested, which is proportionate. Still verify that any NEMO_TOKEN you provide is scoped appropriately for only this service.
Persistence & Privilege
The skill does not request 'always: true', does not include install-time persistence, and does not attempt to modify other skills. It establishes ephemeral sessions with the remote backend as part of normal operation.
Scan Findings in Context
[no_regex_findings] expected: The static regex scanner reported no findings because this is an instruction-only skill with no code files to scan. That absence of findings is expected but not evidence of safety; the SKILL.md itself is the primary surface to review.
What to consider before installing
This skill appears to do what it says — upload videos to a nemovideo.ai backend and return captioned MP4s — but review these points before installing or providing tokens: - Privacy: your video files are uploaded to an external service (mega-api-prod.nemovideo.ai). Do not send confidential or sensitive videos unless you trust the service and its privacy policy. Ask the maintainer for a privacy/security link. - Token use: if you set NEMO_TOKEN in your environment the skill will use it; otherwise it requests an anonymous token from the public endpoint. Only provide tokens scoped to this service and avoid reusing long-lived or privileged credentials. - Metadata mismatch: SKILL.md frontmatter references a config path (~/.config/nemovideo/) and install-path-based X-Skill-Platform detection, but the registry metadata shows no required config paths — ask the author to reconcile this discrepancy (are local config files read?). - Lack of source & provenance: there is no homepage or source repository listed. Prefer skills with a visible source code/release history or vendor documentation. Consider asking the publisher for source code or a privacy/terms link before use. - Operational safety: if you're worried about autonomous uploads, keep the skill user-invocable-only or disable autonomous invocation for your agent; monitor uploads and rotation of any tokens used. If you decide to proceed, test with non-sensitive short clips first and confirm where the output files are stored and how long any backend retains uploaded media.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97dhg7y2y74snrt20akqwhaqs85jgrq
38downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

Getting Started

Ready when you are. Drop your video files here or describe what you want to make.

Try saying:

  • "add a 3-minute YouTube tutorial recording into a 1080p MP4"
  • "add captions in English and Spanish with auto-sync"
  • "adding subtitles to YouTube or social media videos for YouTubers and content creators"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

AI Video Subtitle Generator — Generate and Embed Video Captions

Drop your video files in the chat and tell me what you need. I'll handle the AI subtitle generation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 3-minute YouTube tutorial recording, ask for add captions in English and Spanish with auto-sync, and about 30-60 seconds later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 5 minutes generate subtitles noticeably faster.

Matching Input to Actions

User prompts referencing ai video subtitle generator, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is ai-video-subtitle-generator, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "add captions in English and Spanish with auto-sync" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add captions in English and Spanish with auto-sync" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.

Comments

Loading comments...