Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Convert Video In Text

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — transcribe this video and give me the full text transcript — and get text...

0· 56·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mhogan2013-9/convert-video-in-text.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Convert Video In Text" (mhogan2013-9/convert-video-in-text) from ClawHub.
Skill page: https://clawhub.ai/mhogan2013-9/convert-video-in-text
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install convert-video-in-text

ClawHub CLI

Package manager switcher

npx clawhub@latest install convert-video-in-text
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's stated purpose (transcribe/upload videos) matches the runtime instructions (upload endpoints, session creation, render/export endpoints) and the single required env var NEMO_TOKEN. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) which is not reflected in the registry metadata; that suggests the skill may read a local config directory beyond what's declared.
!
Instruction Scope
Instructions direct the agent to: use NEMO_TOKEN if present or obtain anonymous tokens from https://mega-api-prod.nemovideo.ai; create sessions and upload user-supplied video files to the remote API; and read the skill's YAML frontmatter at runtime and detect install path (~/.clawhub/, ~/.cursor/skills/) to set attribution headers. The request to 'keep the technical details out of the chat' reduces transparency. Reading install paths and a local config directory (per frontmatter) is beyond simple transcription and should be confirmed.
Install Mechanism
No install spec or code is included; this is instruction-only, so nothing new will be written to disk by the skill itself during installation. That is the lowest install risk.
Credentials
Only one credential is declared (NEMO_TOKEN / primaryEnv), which is proportionate for a cloud transcription API. Still: the skill will use any NEMO_TOKEN present in the environment and also claims (in frontmatter) a config path (~/.config/nemovideo/) — confirm whether that path will be read and what it may contain. Avoid placing unrelated/high-privilege secrets in the environment for this skill.
Persistence & Privilege
always is false and the skill does not request permanent platform-wide privileges. It does instruct the agent to create sessions and upload files to a remote service, but it does not request elevated 'always' presence or modify other skills.
What to consider before installing
This skill appears to implement a cloud transcription workflow (you upload videos; the service processes them at mega-api-prod.nemovideo.ai). Before installing: - Confirm the service/operator: no homepage is provided. Verify mega-api-prod.nemovideo.ai and the Nemo service are legitimate and that you trust them with your videos. - Note data flow: any video you send will be uploaded to that external API. Do not upload sensitive or confidential videos unless you accept that. - Environment token: only NEMO_TOKEN is declared. Prefer using the anonymous token flow (ephemeral) rather than placing a long-lived token in your environment unless you trust the service. - Clarify the config-path inconsistency: SKILL.md frontmatter includes ~/.config/nemovideo/ while registry metadata lists no config paths. Ask the skill author whether the agent will read that directory or other local files; if so, what data it reads and why. - Transparency: the instructions say to 'keep technical details out of the chat' — request visible confirmation of uploads, session IDs, and final URLs so you can audit actions. If you cannot verify the service or the config-path behavior, avoid enabling the skill or avoid supplying a persistent NEMO_TOKEN; prefer a disposable anonymous token if you try it.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

📝 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97bc307t7a0m95ebmkht6pc2d85eww2
56downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

Getting Started

Send me your video files and I'll handle the AI transcription conversion. Or just describe what you're after.

Try saying:

  • "convert a 3-minute interview recording into a 1080p MP4"
  • "transcribe this video and give me the full text transcript"
  • "transcribing video dialogue into readable text for content creators, students, journalists"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Convert Video to Text — Transcribe Video Into Text

This tool takes your video files and runs AI transcription conversion through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 3-minute interview recording and want to transcribe this video and give me the full text transcript — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: clear audio with minimal background noise produces more accurate transcripts.

Matching Input to Actions

User prompts referencing convert video in text, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

EndpointMethodPurpose
/api/tasks/me/with-session/nemo_agentPOSTStart a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_ssePOSTSend a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>POSTUpload a file (multipart) or URL.
/api/credits/balance/simpleGETCheck remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latestGETFetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambdaPOSTStart export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: convert-video-in-text
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "transcribe this video and give me the full text transcript" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

MP4 files with H.264 encoding are processed fastest and most reliably.

Common Workflows

Quick edit: Upload → "transcribe this video and give me the full text transcript" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...