Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free To Video

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — turn this text into a short explainer video with visuals and voiceover — a...

0· 73·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vynbosserman65/free-to-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Free To Video" (vynbosserman65/free-to-video) from ClawHub.
Skill page: https://clawhub.ai/vynbosserman65/free-to-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install free-to-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install free-to-video
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (text-to-video) align with the required credential (NEMO_TOKEN) and API calls to a video-rendering backend. No unrelated cloud providers or extra credentials are requested. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier reported no required config paths — this mismatch is unexplained.
Instruction Scope
Runtime instructions are explicit about API endpoints, uploads, SSE streaming, export polling, and how to include attribution headers. Those actions are consistent with a cloud render service. The instructions also tell the agent to auto-acquire an anonymous token if NEMO_TOKEN is not present and to persist a session_id for future calls. They instruct the agent to detect install paths (e.g., ~/.clawhub, ~/.cursor) to set X-Skill-Platform — that requires filesystem access. Overall the scope is appropriate for this feature but contains data-handling steps (automatic token creation, file uploads, local reads/writes) that deserve explicit user consent and clarity.
Install Mechanism
Instruction-only skill with no install spec or code files — lowest install risk. No binaries are installed and nothing is written to disk by an installer step by default.
Credentials
Only one credential (NEMO_TOKEN) is declared which matches the backend API usage. However the skill instructs obtaining and storing an anonymous token automatically if none is provided, which implies the agent will write or persist credentials/session identifiers. The frontmatter also references a config path that was not listed in the registry metadata; this discrepancy should be clarified because it affects what local files the skill may access or create.
Persistence & Privilege
always:false (good). The skill expects to maintain a session_id and potentially store tokens/config under ~/.config/nemovideo/ per its frontmatter and instructs not to display raw tokens to users. That implies local persistence and ongoing remote jobs (orphaned jobs if closed). This is proportionate to a render service but the exact persistence location and permissions are not clearly declared in the registry metadata.
What to consider before installing
This skill appears to do what it says: send your text or uploaded files to a remote video-rendering backend and return an MP4. Before installing, consider: (1) The skill will upload user content (including files up to 500MB) to https://mega-api-prod.nemovideo.ai — do not send sensitive data you wouldn't want transmitted to an external service. (2) It can auto-generate and persist an anonymous NEMO_TOKEN and a session_id; ask where/how these tokens and session state will be stored and for how long. (3) There's a metadata mismatch: SKILL.md mentions ~/.config/nemovideo/ (possible local reads/writes) but the registry says no required config paths — ask the author to clarify what local paths will be read/written. (4) Confirm data retention, privacy, and deletion policies with the service owner and verify the domain is legitimate. (5) If you have strict security requirements, provide your own NEMO_TOKEN only after verifying the service and avoid uploading private content until you confirm storage/retention terms. If you can get clarifications about the config path usage and token storage behavior, I can reassess with higher confidence.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk973w45y4k1xkq9xhb7y7aydcn85b322
73downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Getting Started

Share your text or script and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

  • "convert my text or script"
  • "export 1080p MP4"
  • "turn this text into a short"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Free to Video — Convert Text Into Shareable Videos

This tool takes your text or script and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 150-word product description and want to turn this text into a short explainer video with visuals and voiceover — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: shorter, clearer scripts produce more accurate visuals and faster results.

Matching Input to Actions

User prompts referencing free to video, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: free-to-video
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn this text into a short explainer video with visuals and voiceover" — concrete instructions get better results.

Max file size is 500MB. Stick to TXT, DOCX, PDF, copied text for the smoothest experience.

Export as MP4 for widest compatibility across social and web platforms.

Common Workflows

Quick edit: Upload → "turn this text into a short explainer video with visuals and voiceover" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...