Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Rtk Compressor

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — compress this RTK video file to under 500MB without losing quality — and g...

0· 82·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for dsewell-583h0/free-rtk-compressor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Free Rtk Compressor" (dsewell-583h0/free-rtk-compressor) from ClawHub.
Skill page: https://clawhub.ai/dsewell-583h0/free-rtk-compressor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install free-rtk-compressor

ClawHub CLI

Package manager switcher

npx clawhub@latest install free-rtk-compressor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to compress/upload video via a cloud backend and all described API endpoints and actions align with that purpose. Requesting a NEMO_TOKEN to authenticate with the backend is appropriate. However, the frontmatter and registry metadata mismatch: the SKILL.md includes a configPaths entry (~/.config/nemovideo/) but the registry metadata earlier listed no required config paths; this inconsistency should be clarified.
Instruction Scope
Instructions are mainly limited to interacting with the remote nemovideo.ai API (session creation, SSE chat, upload, export) which is in-scope. They also instruct: (1) creating an anonymous token if NEMO_TOKEN isn't present, (2) including attribution headers and detecting the agent install path (~/.clawhub/, ~/.cursor/skills/) to set X-Skill-Platform, and (3) reading YAML frontmatter for version. Reading the agent install path and frontmatter is benign but expands scope beyond pure upload/encode actions and could reveal local environment details; the skill doesn't explicitly say whether it will persist tokens or write to ~/.config/nemovideo/.
Install Mechanism
This is an instruction-only skill with no install spec or added binaries, so there is no download/extract risk. That lowers disk-write and supply-chain risk.
!
Credentials
The registry lists NEMO_TOKEN as a required env var and the frontmatter marks it as primaryEnv, which is proportional for a cloud video service. However, SKILL.md also instructs the agent to automatically request an anonymous token if NEMO_TOKEN is not found (and the frontmatter includes a configPaths entry). This is a mismatch: the skill both requires an env var and contains logic to generate one. It's unclear whether the generated anonymous token is stored locally (e.g., under ~/.config/nemovideo/) or kept only in memory; persistent storage would increase risk. Also the skill will read install paths to set attribution headers — that reveals filesystem layout.
Persistence & Privilege
always is false and the skill does not request elevated persistent privileges. However, the presence of configPaths in the frontmatter suggests it may write/read under ~/.config/nemovideo/ (not declared elsewhere); clarify whether the skill will store tokens or state on disk. Autonomous invocation is allowed (normal) and not a standalone concern here.
What to consider before installing
This skill appears to do what it says (upload video to a cloud compressor) but has a few inconsistencies you should clear up before installing: 1) The registry declares NEMO_TOKEN as required, but the instructions also generate an anonymous NEMO_TOKEN if none is present — ask whether the skill will persist that token to disk (e.g., ~/.config/nemovideo/) or keep it only in memory. Persistent storage would increase risk. 2) The skill will read the agent's install path and YAML frontmatter to set X-Skill-Platform/version headers — this reveals some local environment details; confirm exactly which paths are read. 3) All uploads go to a third-party domain (mega-api-prod.nemovideo.ai); verify you trust that service and its privacy policy because uploaded video content may include sensitive data. Recommendations before use: do not set any high-privilege credentials as NEMO_TOKEN, test the skill in a sandboxed environment with non-sensitive videos first, ask the author to clarify the configPath usage and token persistence behavior, and if possible review network traffic or logs to confirm tokens are not exfiltrated to unexpected endpoints. If the author confirms no tokens are stored on disk and configPaths are unused, and the only credential is a limited anonymous token, the inconsistencies become less concerning.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🗜️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk970zmnxptap34n6zjppqt290s84pm2b
82downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Getting Started

Share your raw video files and I'll get started on AI video compression. Or just tell me what you're thinking.

Try saying:

  • "compress my raw video files"
  • "export 1080p MP4"
  • "compress this RTK video file to"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

  • Generate a UUID as client identifier
  • POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
  • Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Free RTK Compressor — Compress and Export RTK Videos

This tool takes your raw video files and runs AI video compression through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 2GB MP4 gameplay recording and want to compress this RTK video file to under 500MB without losing quality — the backend processes it in about 1-3 minutes and hands you a 1080p MP4.

Tip: shorter clips compress faster — split long recordings before uploading.

Matching Input to Actions

User prompts referencing free rtk compressor, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: free-rtk-compressor
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "compress this RTK video file to under 500MB without losing quality" — concrete instructions get better results.

Max file size is 2GB. Stick to MP4, MOV, AVI, MKV for the smoothest experience.

H.264 codec gives the best balance of quality and size.

Common Workflows

Quick edit: Upload → "compress this RTK video file to under 500MB without losing quality" → Download MP4. Takes 1-3 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...