Mosaic Video Editor

AI-powered video editing via the Mosaic API. Create agents, run video workflows, manage social accounts, publish content, upload assets, and handle credits....

Security Scan

The skill's requirements and instructions align with its stated Mosaic video-editing purpose; the only notable issues are that it asks the agent to persist the user's API key in the environment and to perform billing/social-publishing actions which the user should explicitly approve.

Purpose & Capability

Name/description match required resources and actions: the skill calls Mosaic API endpoints, lists node types, runs agents, uploads assets, publishes to social platforms, and manages credits. Requesting a single MOSAIC_API_KEY is appropriate for this purpose and no unrelated credentials or binaries are requested.

Instruction Scope

SKILL.md contains concrete API call instructions and endpoint references for agent runs, uploads, social publishing, and billing. It stays within Mosaic API scope. Two items to note: (1) it instructs the agent to ask the user for an API key if not present and to 'store the key as MOSAIC_API_KEY in your environment for future sessions', which implies persisting secrets across sessions; (2) it prescribes flows that can change billing state (POST /plan/upgrade and POST /credits/settings) and publish to social accounts — these are expected for the skill but have real-world side effects and require explicit user consent.

Install Mechanism

No install spec and no code files to execute; this is an instruction-only skill (lowest install risk). All behavior is driven by runtime HTTP calls described in the SKILL.md and manifest docs.

Credentials

Only MOSAIC_API_KEY is required (primary credential), which is proportional to a Mosaic API integration. The instruction to persist the key in the environment is a user-interface/design decision rather than a technical need; users should be aware persisting keys may expose them to other skills or sessions if environment storage is shared.

Persistence & Privilege

always:false (normal). The skill can be invoked autonomously (disable-model-invocation:false) which is the platform default. Combined with the ability to upgrade plans, enable auto top-ups, and publish to social accounts, autonomous operation could perform actions with financial or reputational consequences — this is expected functionality but worth explicit user controls/consent.

Scan Findings in Context

[no_regex_findings] expected: The regex-based scanner reported nothing; the skill is instruction-only and contains no executable code files for the scanner to analyze. This absence of findings is not evidence of safety — review the SKILL.md behavior (billing, key persistence, social publishing).

Assessment

This skill appears to be what it says: a Mosaic API integration that needs your MOSAIC_API_KEY. Before installing or enabling it: (1) only provide a Mosaic API key you trust and be aware the SKILL.md asks the agent to persist that key in the environment — confirm how and where keys are stored in your agent runtime; (2) the skill can initiate billing flows (plan upgrades and auto top-ups) and publish to social accounts — do not allow or automate those actions unless you explicitly approve each operation; (3) consider restricting autonomous invocation if you do not want the agent to perform upgrades or publish without manual confirmation; (4) verify the homepage (https://edit.mosaic.so) and that you trust the skill source/owner before sharing credentials. If you want higher assurance, ask the skill author for a signed provenance or an official Mosaic maintainer confirmation.

Mosaic API Skill

With Mosaic you are an AI video editor. You create and run video editing workflows ("Agents"), upload media, connect social accounts, and publish edited videos automatically.

API key setup

Before any API call, you need a Mosaic API key (prefixed mk_).

1. Check the environment first. If MOSAIC_API_KEY is already set (e.g. via the one-click setup at edit.mosaic.so), use it directly.
2. If the key is not in the environment, ask the user for it. Direct them to edit.mosaic.so/automations?tab=api to generate one using the one-click setup for OpenClaw or Claude Code.
3. Store the key as MOSAIC_API_KEY in your environment for future sessions.
4. Validate with GET https://api.mosaic.so/whoami using header Authorization: Bearer $MOSAIC_API_KEY.

HTTP conventions

• Base URL: https://api.mosaic.so
• Auth: Authorization: Bearer $MOSAIC_API_KEY
• Content: Content-Type: application/json

Workflows

Each workflow has its own guide. Read the relevant file for the task at hand.

Task	Guide
Create and manage agents	workflows/managing-agents.md
Run an agent on video	workflows/running-agents.md
Upload video/audio/image assets	workflows/uploading-assets.md
Publish to social platforms	workflows/social-publishing.md
Credits, billing, and auto top-ups	workflows/credits-and-billing.md

Nodes (tiles)

Agents are graphs of nodes (also called "tiles"). Each node performs one editing action. To discover available nodes and their parameters, call:

GET /node_types          — list all node types
GET /node_type/{node_type_id} — get details for a specific node

Per-node reference files with IDs and docs links are in the nodes/ directory. Read the relevant node file when you need parameter details for update_params.

Editing best practices

• For tighter edits, place Rough Cut or Clips before style nodes.
• Place Reframe before layout-sensitive nodes (Captions, Cinematic Captions, Motion Graphics, Watermark).
• Chain edits by passing prior node_render_ids to subsequent runs.

Guardrails

• update_params keys must match agent_node_id values from GET /agent/{agent_id}.
• Invalid overrides return 400.
• For captions, caption_font_weight must be string-typed (e.g. "700").
• For Motion Graphics, use style_video_url and only_generate_full_screen_graphics.
• If a run is credit-blocked (needs_credits: true or needsCredits: true), follow the required plan-check and upgrade flow in workflows/credits-and-billing.md before attempting resume.
• Do not use GET /credits/settings for reads; use GET /credits to inspect current auto-topup configuration.
• For free/no paid plan users, list options from GET /plan/list, prompt for plan_id, then run POST /plan/upgrade.
• After successful upgrade, always ask whether to enable auto top-ups; if yes, configure via POST /credits/settings with user-provided thresholds.

Endpoint map

Full endpoint reference: references/docs-endpoints.md