Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meta Video Generation Free

v1.0.0

Turn a short product description and three brand images into 1080p ready-to-share videos just by typing what you need. Whether it's generating videos from te...

0· 86·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whitejohnk-26/meta-video-generation-free.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Meta Video Generation Free" (whitejohnk-26/meta-video-generation-free) from ClawHub.
Skill page: https://clawhub.ai/whitejohnk-26/meta-video-generation-free
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install meta-video-generation-free

ClawHub CLI

Package manager switcher

npx clawhub@latest install meta-video-generation-free
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (video generation) aligns with the API endpoints and flows described. Requesting a single service token (NEMO_TOKEN) is proportionate. However the SKILL.md frontmatter declares a configPaths entry (~/.config/nemovideo/) while the registry metadata shows no required config paths — this mismatch is an inconsistency worth clarifying. The skill's homepage/source are unknown which reduces transparency but does not by itself contradict purpose.
!
Instruction Scope
The runtime instructions direct the agent to automatically obtain an anonymous token from an external API if NEMO_TOKEN is not present, create and store session_id, upload local files (multipart/form-data with file paths), and map GUI actions to API calls. They also explicitly instruct to 'Don't display raw API responses or token values' which is reasonable for secret handling but also means token values and raw responses may be hidden from the user — increasing risk if the backend or skill is untrusted. The instructions reference detecting an install path to set X-Skill-Platform and require storing session state; those filesystem/agent-context interactions are broader than a simple stateless API client and may cause the agent to read/write local config.
Install Mechanism
No install spec and no code files are included — this is instruction-only, so nothing is written to disk by an installer. That minimizes installer-level risk.
Credentials
Only NEMO_TOKEN is declared as required, which is reasonable for a cloud video service. The SKILL.md, however, instructs auto-creation and local storage of the token and session_id; automatic generation plus opaque storage can grant persistent access to the external service without the user explicitly providing credentials. Also the frontmatter's configPaths entry (not reflected in registry requirements) suggests the skill expects to read/write ~/.config/nemovideo/ — this should be explicit to the user.
Persistence & Privilege
always:false (normal) and autonomous invocation is allowed (platform default). The skill's instructions to store session_id / token and to use a config path imply persistence of credentials/session state across uses. That persistence is not inherently malicious but increases the blast radius if the external service or token issuance is abused. The skill does not request elevated platform-wide privileges, nor does it claim to modify other skills.
What to consider before installing
This skill is plausible for cloud video generation but take these precautions before installing: - Prefer to provide your own NEMO_TOKEN instead of letting the skill auto-create and store one; review where the token/session will be stored (it references ~/.config/nemovideo/ in the frontmatter but registry metadata omits that). - Confirm you trust mega-api-prod.nemovideo.ai and the organization behind it (homepage and source are missing). Uploaded files and prompts will be sent to that external service. - Be aware the skill hides raw API responses and token values; ask for explicit visibility of what is stored and when tokens are created/used. - If you need tighter control, set NEMO_TOKEN yourself and refuse automatic anonymous-token creation, and monitor outgoing network calls while using the skill. - If you are uncomfortable with opaque token storage or the missing source/homepage, treat this as risky and avoid installation until the publisher provides more transparency.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97e32rxee6n67pcv9jv9rmx3d859qrq
86downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Getting Started

Share your text or images and I'll get started on AI video generation. Or just tell me what you're thinking.

Try saying:

  • "generate my text or images"
  • "export 1080p MP4"
  • "generate a 30-second video from my"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Meta Video Generation Free — Generate Videos from Text or Images

Drop your text or images in the chat and tell me what you need. I'll handle the AI video generation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a short product description and three brand images, ask for generate a 30-second video from my product photos and tagline, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter text prompts with clear subject descriptions produce more accurate results.

Matching Input to Actions

User prompts referencing meta video generation free, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcemeta-video-generation-free
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "generate a 30-second video from my product photos and tagline" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a 30-second video from my product photos and tagline" — concrete instructions get better results.

Max file size is 200MB. Stick to JPG, PNG, MP4, MOV for the smoothest experience.

Export as MP4 for widest compatibility.

Comments

Loading comments...