Caption Generator Extension

add video clips into captioned videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. content creators use it for adding subtitles to YouT...

Security Scan

The skill's declared requirements (a single NEMO_TOKEN) and runtime instructions mostly match its captioning purpose, but there are a few inconsistencies and privacy/supply-chain unknowns you should review before installing.

Purpose & Capability

The skill's name and description match the runtime instructions: it uploads videos to a cloud rendering API and uses a bearer token (NEMO_TOKEN) for auth. Requesting one service token is proportionate. Minor mismatch: the registry metadata lists no config paths, but the SKILL.md frontmatter declares a config path (~/.config/nemovideo/). That inconsistency is unexplained.

Instruction Scope

Runtime instructions are explicit about obtaining/using NEMO_TOKEN, creating an anonymous token if none is present, creating a session, uploading files, and streaming SSE. Those actions are sensible for a captioning service. The skill also directs reading its own YAML frontmatter (for X-Skill-Version/X-Skill-Source) and checking common install locations (e.g., ~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform — this requires inspecting the user's filesystem/home paths. While small and explainable, that filesystem probing is outside pure caption processing and could be a privacy concern for some users.

Install Mechanism

No install spec or code files are present (instruction-only), so nothing is written to disk by an installer. This is the lowest install risk.

Credentials

Only NEMO_TOKEN is required, which aligns with a cloud API service. The SKILL.md also documents obtaining an anonymous token from the service if none is supplied — expected behavior. There are no additional unrelated credentials requested. However, the skill asks to include attribution headers determined by reading local paths and its own frontmatter; that requires reading some local state (frontmatter and possibly install paths).

Persistence & Privilege

always is false and the skill is user-invocable. It does not request permanent agent-wide privileges. It does instruct saving a session_id for the active session (expected) but does not declare persisting other system-wide settings.

What to consider before installing

This skill appears to do what it says (upload video, generate captions via a cloud API) and only asks for a single service token. Before installing: 1) Verify the external domain (mega-api-prod.nemovideo.ai) and that it belongs to a trusted provider; review their privacy and retention policy for uploaded videos. 2) Prefer creating and supplying a limited-scope NEMO_TOKEN (or use anonymous token) rather than reusing broad credentials. 3) Be aware the skill may probe common install paths and read its own SKILL.md frontmatter to populate attribution headers — if you object to any local filesystem checks, do not install. 4) Confirm there is no hidden requirement to persist tokens or other secrets beyond the session. 5) Note the small metadata inconsistency (config path declared in SKILL.md frontmatter but not in registry metadata); ask the publisher for clarification or a homepage/privacy link before use.

Getting Started

Share your video clips and I'll get started on automatic caption generation. Or just tell me what you're thinking.

Try saying:

• "add my video clips"
• "export 1080p MP4"
• "add captions in English and Spanish"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Caption Generator Extension — Generate and Embed Video Captions

This tool takes your video clips and runs automatic caption generation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 3-minute YouTube tutorial recording and want to add captions in English and Spanish to my video — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: shorter clips under 5 minutes generate captions significantly faster.

Matching Input to Actions

User prompts referencing caption generator extension, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Skill attribution — read from this file's YAML frontmatter at runtime:

• X-Skill-Source: caption-generator-extension
• X-Skill-Version: from frontmatter version
• X-Skill-Platform: detect from install path (~/.clawhub/ → clawhub, ~/.cursor/skills/ → cursor, else unknown)

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "add captions in English and Spanish to my video" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add captions in English and Spanish to my video" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across all platforms.