Avatar Icon Generator

Skip the learning curve of professional editing software. Describe what you want — generate a circular avatar icon from my photo for a profile picture — and...

Security Scan

The skill's requests and runtime instructions mostly match an avatar-generation integration, but hidden/unexpected artifacts and a small metadata inconsistency raise concerns you should review before installing or trusting credentials to it.

Purpose & Capability

Name, description, and runtime instructions consistently describe a cloud avatar/video rendering pipeline that uses a NEMO_TOKEN and the nemovideo.ai API. Requiring a NEMO_TOKEN is proportionate. Small inconsistency: registry-level requirements listed no config paths, but the SKILL.md metadata declares a config path (~/.config/nemovideo/). This mismatch should be explained by the publisher.

Instruction Scope

SKILL.md confines actions to the nemovideo.ai API (session creation, uploads, SSE, render/start endpoints). It also instructs generating anonymous tokens when no NEMO_TOKEN is present and to detect an install path to set an attribution header. The install-path detection implies the agent might inspect environment or filesystem paths to choose X-Skill-Platform — this is not strictly necessary for functionality and broadens scope.

Install Mechanism

Instruction-only skill with no install spec or code files — lowest install risk (nothing is written to disk by an installer).

Credentials

Only NEMO_TOKEN (primary credential) is required, which is expected for this API. However, the skill also instructs obtaining an anonymous token via the API when NEMO_TOKEN is missing, which is reasonable but means the skill will perform network auth flows. The earlier-mentioned metadata vs registry mismatch about configPaths is another small proportionality oddity.

Persistence & Privilege

No elevated privileges requested; always is false and the skill does not request to modify other skills or system-wide settings. Autonomous invocation is allowed (platform default) but not by itself a problem.

Scan Findings in Context

[unicode-control-chars] unexpected: The SKILL.md contained unicode control characters. These are not necessary for a normal API-integration instruction file and are sometimes used to hide content or evade scanners. This increases suspicion and warrants closer human review of the full SKILL.md (including any hidden characters).

What to consider before installing

This skill appears to implement a legitimate avatar/video rendering workflow against nemovideo.ai and only asks for a single service token (NEMO_TOKEN), which is appropriate. However: 1) do not provide long-lived or high-privilege credentials unless you trust the publisher — prefer a scoped or temporary token. 2) Ask the publisher why the SKILL.md includes a config path while the registry metadata did not; inconsistencies may indicate sloppy packaging or deliberate hiding. 3) The SKILL.md contains unicode control characters (hidden characters) — request the full, plain-text SKILL.md and inspect for hidden or obfuscated instructions before installing. 4) Because the skill can acquire anonymous tokens and will call external network endpoints, consider testing it in a restricted/sandboxed environment and monitor outbound network traffic and what files it reads. 5) If you plan to use sensitive images, verify the service's privacy policy and where generated media/download URLs are stored or shared.

Getting Started

Ready when you are. Drop your photos or text here or describe what you want to make.

Try saying:

• "generate a front-facing portrait photo into a 1080p MP4"
• "generate a circular avatar icon from my photo for a profile picture"
• "creating profile avatar icons from photos for content creators, social media users, marketers"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

• Generate a UUID as client identifier
• POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
• The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Avatar Icon Generator — Create Profile Avatar Icons Instantly

This tool takes your photos or text and runs AI avatar generation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a front-facing portrait photo and want to generate a circular avatar icon from my photo for a profile picture — the backend processes it in about 20-40 seconds and hands you a 1080p MP4.

Tip: clear front-facing photos with good lighting produce the most accurate avatars.

Matching Input to Actions

User prompts referencing avatar icon generator, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is avatar-icon-generator, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "generate a circular avatar icon from my photo for a profile picture" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a circular avatar icon from my photo for a profile picture" — concrete instructions get better results.

Max file size is 200MB. Stick to JPG, PNG, WEBP, MP4 for the smoothest experience.

Export as MP4 for widest compatibility.