Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Caption Generator Gemini

v1.0.0

generate video clips into captioned videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers use it for adding AI-generated subtit...

0· 41·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description align with the actions in SKILL.md (upload video, request captions, export MP4). Required credential (NEMO_TOKEN) is consistent with a remote API. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) that the registry metadata did not declare — an inconsistency to investigate (why would it need local config files?).
!
Instruction Scope
Instructions direct the agent to obtain anonymous tokens automatically, create sessions, upload user files to https://mega-api-prod.nemovideo.ai, and persist session state. They also instruct the agent not to display raw API responses or token values to users. Auto-generating/storing tokens and hiding raw responses reduces transparency and could enable persistent credentials or opaque background behavior; the SKILL.md also asks the agent to auto-detect an install path for X-Skill-Platform which may require reading environment/paths outside the skill's immediate scope.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest install risk (nothing is downloaded or written by an installer).
Credentials
Only a single credential (NEMO_TOKEN) is required, which is appropriate for a hosted service. But the SKILL.md implies creating/storing anonymous tokens (valid 7 days) and references a config dir in metadata; it's unclear whether tokens/session IDs will be persisted to disk and where. That lack of clarity affects proportionality/privacy.
Persistence & Privilege
always:false and no explicit persistent install — good. But the skill instructs storing session_id and possibly using ~/.config/nemovideo/ (per SKILL.md frontmatter), which could create persistent credentials or state. Autonomous invocation is allowed by default (normal), so combined with opaque token handling this increases potential blast radius.
What to consider before installing
This skill appears to call an external captioning API and will upload your video files to mega-api-prod.nemovideo.ai. Before installing or using it: (1) Verify you trust the nemovideo.ai service and the skill author (no homepage or known owner provided). (2) Ask where tokens/session IDs are stored (in-memory only or written to ~/.config/nemovideo/?), and whether the skill will persist them; consider supplying your own token rather than letting the skill auto-create one. (3) Be cautious because the skill explicitly tells the agent not to show raw API responses or token values — reduced transparency. (4) If you handle sensitive video/audio, avoid using a third‑party cloud service you can't audit. (5) If you still want to proceed, limit exposure by using throwaway/anonymous accounts or test with non-sensitive files and request clarification from the publisher about the config-path discrepancy and data retention/privacy policy.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

💬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97eyc0cw1yw4zpb462s06vepn84x3b2
41downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

Getting Started

Send me your video clips and I'll handle the AI caption generation. Or just describe what you're after.

Try saying:

  • "generate a 2-minute YouTube tutorial video into a 1080p MP4"
  • "add captions in English and Spanish using Gemini AI"
  • "adding AI-generated subtitles to videos for YouTubers"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Caption Generator Gemini — Generate AI Captions for Videos

Send me your video clips and describe the result you want. The AI caption generation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute YouTube tutorial video, type "add captions in English and Spanish using Gemini AI", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: shorter clips under 3 minutes produce the most accurate Gemini captions.

Matching Input to Actions

User prompts referencing caption generator gemini, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcecaption-generator-gemini
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "add captions in English and Spanish using Gemini AI" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add captions in English and Spanish using Gemini AI" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.

Comments

Loading comments...