Linkedin Photo Video Maker

professionals and job seekers create photos or images into LinkedIn-ready video using this skill. Accepts JPG, PNG, HEIC, WebP up to 200MB, renders on cloud...

Security Scan

The skill's declared purpose (turning photos into LinkedIn-ready videos) matches the network calls and single credential it needs, but missing provenance, a mismatch about requested config paths, and instructions that may read local config/install paths make the package incoherent enough to warrant caution.

Purpose & Capability

The name/description align with the runtime instructions (upload images, create a session, call rendering/export endpoints). Requesting a single service token (NEMO_TOKEN) is appropriate for a cloud render service. However the skill metadata inside SKILL.md lists a config path (~/.config/nemovideo/) while registry metadata showed no required config paths — this mismatch is unexplained. Also the skill has no published homepage or source repository, and the owner identifier is opaque, reducing provenance.

Instruction Scope

The SKILL.md explicitly instructs the agent to: read NEMO_TOKEN from the environment (or obtain an anonymous token), create sessions, upload files, call SSE endpoints and poll for render results — all consistent with the stated purpose. But it also describes detecting an "install path" (~/.clawhub, ~/.cursor/skills) and references a local config directory (~/.config/nemovideo/) for attribution headers or detection purposes. That implies filesystem checks beyond simply uploading user-provided images. If the agent automatically reads home-directory paths to detect platform or cached tokens, that expands scope and could expose local tokens/configs unintentionally.

Install Mechanism

Instruction-only skill with no install spec and no code files. That limits on-disk persistence or arbitrary code download — expected and lower-risk from an install perspective.

Credentials

Only NEMO_TOKEN is required as declared (primaryEnv). That is proportionate for a rendering API. However the instructions will use any NEMO_TOKEN present in the environment automatically, and also direct the agent to obtain an anonymous token if none exists. Users should be aware the skill will accept and use an already-present NEMO_TOKEN (possibly belonging to the user), and that uploaded images and metadata will be sent to the external endpoint. The SKILL.md metadata referencing an on-disk config path is not reflected in the registry metadata — inconsistent.

Persistence & Privilege

The skill is not always-enabled and does not request elevated or permanent platform privileges. It does not instruct modifying other skills or system-wide settings. Autonomous invocation is allowed by default (normal), but no extra privileges are requested.

What to consider before installing

This skill generally does what it says — it uploads your images to a third-party rendering API and returns MP4s — but there are a few red flags to consider before installing: 1) Provenance: there is no homepage or source code and the publisher ID is opaque; if you need vendor accountability, ask for a source repo or company page. 2) Tokens: the skill will automatically use any NEMO_TOKEN in the environment; only supply a token that you explicitly want the skill to use (create a throwaway or anonymous token if possible). 3) Local file access: SKILL.md references ~/.config/nemovideo/ and checks install paths (~/.clawhub, ~/.cursor/skills) — confirm whether the agent will actually read these paths; if you have sensitive config files, avoid installing until clarified. 4) Data privacy: uploaded images and metadata are sent to mega-api-prod.nemovideo.ai; review the service's privacy/retention policy or test with non-sensitive images first. 5) Missing info that would increase confidence: a public homepage or repo, a clear statement whether the skill actually reads local config paths, and example responses from the API. If you cannot obtain that, proceed cautiously or avoid providing production credentials/tokens.

Getting Started

Share your photos or images and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

• "create my photos or images"
• "export 1080p MP4"
• "turn my photos into a LinkedIn"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

• Generate a UUID as client identifier
• POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
• The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

LinkedIn Photo Video Maker — Turn Photos Into LinkedIn Videos

This tool takes your photos or images and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have three professional headshots and a logo and want to turn my photos into a LinkedIn intro video with text overlays and background music — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: use a square or landscape crop on your photo for the cleanest LinkedIn feed preview.

Matching Input to Actions

User prompts referencing linkedin photo video maker, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is linkedin-photo-video-maker, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "turn my photos into a LinkedIn intro video with text overlays and background music" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn my photos into a LinkedIn intro video with text overlays and background music" — concrete instructions get better results.

Max file size is 200MB. Stick to JPG, PNG, HEIC, WebP for the smoothest experience.

Export as MP4 for widest compatibility with LinkedIn uploads.