Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Free Video Compressor

v1.0.0

Turn a 500MB MP4 recording from a DSLR into 1080p compressed MP4 files just by typing what you need. Whether it's reducing video file size for uploading or s...

0· 93·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vcarolxhberger/free-video-compressor.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Free Video Compressor" (vcarolxhberger/free-video-compressor) from ClawHub.
Skill page: https://clawhub.ai/vcarolxhberger/free-video-compressor
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install free-video-compressor

ClawHub CLI

Package manager switcher

npx clawhub@latest install free-video-compressor
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to perform cloud-based video compression and the SKILL.md describes API endpoints, upload, render, and download flows that match that purpose. Requiring a NEMO_TOKEN as the primary credential is plausible for a cloud service. However, the SKILL.md also documents acquiring an anonymous token if NEMO_TOKEN is absent, so declaring NEMO_TOKEN as a required env var (registry metadata) is inconsistent with the runtime instructions.
!
Instruction Scope
Instructions tell the agent to call external endpoints (https://mega-api-prod.nemovideo.ai), upload files via multipart, create/poll sessions, and stream SSEs — all expected for a cloud render pipeline. Concerns: the skill instructs the agent to detect install paths (~/.clawhub/, ~/.cursor/skills/) and to read YAML frontmatter/version for attribution headers; detecting those requires checking local filesystem paths. The skill's metadata also references '~/.config/nemovideo/' which suggests reading a local config directory. Reading local paths and config is outside pure upload/render needs and should be justified to the user. Otherwise the instruction scope is narrowly about uploads and API calls and otherwise appropriate.
Install Mechanism
This is an instruction-only skill with no install spec and no code files. That is the lowest-risk install profile — nothing is automatically downloaded or written to disk by an installer.
!
Credentials
The only declared required env var is NEMO_TOKEN, which is appropriate for calling the service. But the runtime instructions explicitly support generating an anonymous token when NEMO_TOKEN is absent, making a required-NEMO_TOKEN assertion inconsistent. The SKILL.md also references a local config path (~/.config/nemovideo/) and asks the agent to detect install path for attribution headers; requiring or accessing those paths is not clearly necessary for core compression functionality and raises proportionality questions. No other unrelated secrets are requested.
Persistence & Privilege
The skill is not marked 'always:true' and does not request system-wide persistent privileges. It describes session lifecycle for backend render jobs (including orphaning if the client closes), which is normal for a remote render service. There is no instruction to modify other skills or agent-wide configuration.
What to consider before installing
This skill appears to implement a cloud video-compression workflow, but there are a few things to confirm before installing or using it: - Ask the publisher whether NEMO_TOKEN is truly required; the runtime doc shows an anonymous-token fallback, so NEMO_TOKEN might be optional. Do not set a long-lived high-privilege credential in NEMO_TOKEN unless you trust the service and its privacy policy. - The skill may check local paths (install locations, ~/.config/nemovideo/) and read its YAML frontmatter/version — confirm what local files it will read and why. If you don’t want the skill to inspect your home directory, do not grant filesystem access. - The skill uploads files to https://mega-api-prod.nemovideo.ai. Only upload videos you are comfortable sending to a third-party service. Check the service’s privacy and retention policy if available. - Because this is instruction-only, there’s no automatic installer, but the agent will perform network calls that could transmit data; prefer using anonymous tokens or short-lived credentials when testing. If you want higher assurance, ask the skill author for: (1) a privacy/retention statement for uploaded media, (2) clarity on which local paths are read and why, and (3) whether NEMO_TOKEN is optional and what scopes it grants.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🗜️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk972c3b7ysm3ej6k3vxymc9qk5855p4m
93downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Ready when you are. Drop your video files here or describe what you want to make.

Try saying:

  • "compress a 500MB MP4 recording from a DSLR into a 1080p MP4"
  • "compress this video to under 50MB without losing too much quality"
  • "reducing video file size for uploading or sharing for content creators, students, marketers"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Free Video Compressor — Compress and Export Smaller Videos

This tool takes your video files and runs AI video compression through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 500MB MP4 recording from a DSLR and want to compress this video to under 50MB without losing too much quality — the backend processes it in about 30-90 seconds and hands you a 1080p MP4.

Tip: shorter clips compress faster and give you more control over the output size.

Matching Input to Actions

User prompts referencing free video compressor, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: free-video-compressor
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "compress this video to under 50MB without losing too much quality" → Download MP4. Takes 30-90 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "compress this video to under 50MB without losing too much quality" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

H.264 codec gives the best balance of quality and size.

Comments

Loading comments...