Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Best Demo Video

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — trim the intro, add titles for each feature, and export as a clean demo —...

0· 103·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for tk8544-b/best-demo-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Best Demo Video" (tk8544-b/best-demo-video) from ClawHub.
Skill page: https://clawhub.ai/tk8544-b/best-demo-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install best-demo-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install best-demo-video
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the runtime instructions: the SKILL.md describes uploading raw video, creating sessions, editing via SSE, and exporting via a nemovideo cloud API. Requesting a single service token (NEMO_TOKEN) is consistent with this purpose. However, the SKILL.md frontmatter lists a configPaths entry (~/.config/nemovideo/) while the registry metadata lists no required config paths — an inconsistency that should be clarified.
Instruction Scope
Instructions stay within the video-editing domain: obtain or reuse a NEMO_TOKEN, create a session, upload videos (up to 500MB), drive edits via SSE, and poll for exports. A potentially unexpected runtime step is 'detecting the install path' to set an X-Skill-Platform header (e.g., ~/.clawhub/ or ~/.cursor/skills/), which implies filesystem/environment inspection that isn't declared elsewhere. The skill also instructs deriving headers from the file's YAML frontmatter — reading the SKILL.md itself is expected, but any actions that probe other paths were not clearly authorized in the registry metadata.
Install Mechanism
This is instruction-only (no install spec, no code files). That minimizes disk-executed code risk; the skill's runtime behavior consists of outbound API calls to the nemovideo endpoints described in SKILL.md.
Credentials
Only one credential is requested (NEMO_TOKEN), which is appropriate for a cloud API client. The SKILL.md also includes a configPaths value (~/.config/nemovideo/) in its frontmatter, but the registry lists none — this mismatch may indicate either an omitted declaration or that the skill expects to read/write a local config directory. Confirm whether the skill will access that path and why.
Persistence & Privilege
always is false and the skill is user-invocable. It asks to save a session_id and to reuse or refresh tokens (normal behavior). It does not request permanent/always-on privileges or modify other skills' configs.
What to consider before installing
This skill calls an external API (mega-api-prod.nemovideo.ai), uploads user media, and requires a NEMO_TOKEN (you can use an anonymous token flow described in the SKILL.md). Before installing: (1) confirm the skill's publisher and source (homepage is missing); (2) decide whether you trust the nemovideo service to store/process your videos and review its privacy/retention policy; (3) if you prefer, use an anonymous/limited token (as described) rather than a long-lived credential or account token; (4) ask the author to clarify the configPaths discrepancy (~/.config/nemovideo/ appears in SKILL.md but not in registry) and whether the skill will read or write files outside its own data; (5) avoid supplying highly sensitive footage until you verify where and how exports/uploads are stored. The inconsistencies look like packaging sloppiness rather than overt malice, but treat tokens and uploaded media as sensitive.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk976ttbhgheaftx3g3qcte8sn585477z
103downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Share your raw footage and I'll get started on AI demo video creation. Or just tell me what you're thinking.

Try saying:

  • "create my raw footage"
  • "export 1080p MP4"
  • "trim the intro, add titles for"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Best Demo Video — Create and Export Demo Videos

This tool takes your raw footage and runs AI demo video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 2-minute screen recording of a software feature and want to trim the intro, add titles for each feature, and export as a clean demo — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: keep your demo under 90 seconds for the highest viewer retention.

Matching Input to Actions

User prompts referencing best demo video, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is best-demo-video, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the intro, add titles for each feature, and export as a clean demo" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across browsers and platforms.

Common Workflows

Quick edit: Upload → "trim the intro, add titles for each feature, and export as a clean demo" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...