NemoVideo - AI Video Editor & Creator

Video editor, video creator, video editing tool powered by AI. Edit videos, create videos, make videos from text — all through chat, no GUI needed. Full vide...

Security Scan

The skill's requests and runtime instructions are consistent with an AI video-editing frontend: it talks to a NemoVideo API, may persist a client_id and an anonymous token, and asks only for a single primary credential (NEMO_TOKEN).

Purpose & Capability

Name/description match the instructions: the SKILL.md documents contacting a NemoVideo backend to create/edit/export videos via SSE, upload endpoints, and export flows. Required artifacts (client id, token, API URL) are coherent with a remote video service.

Instruction Scope

Instructions tell the agent to perform network calls (SSE/curl) to the NemoVideo API, handle long-running generation, and upload user files. The skill also reads/writes a local file (~/.config/nemovideo/client_id) and tells the agent to persist an anonymous token as NEMO_TOKEN. These actions are within the expected scope for a remote video service but do involve creating local state and transmitting media to an external endpoint.

Install Mechanism

Instruction-only skill with no install spec or code to download; lowest install risk. All runtime behavior is performed via curl-like requests described in SKILL.md.

Credentials

Only one declared primary credential (NEMO_TOKEN). The skill optionally uses NEMO_API_URL and persists NEMO_CLIENT_ID to a user config path. The requested env/credentials are proportionate to a cloud video editor; no unrelated secrets are requested.

Persistence & Privilege

always:false (no forced global presence). The skill instructs persisting a client_id to ~/.config/nemovideo/client_id and storing an anonymous token (NEMO_TOKEN). This is limited to the skill's own data and does not modify other skills or system-wide agent settings.

Assessment

This skill appears internally consistent for a cloud-based AI video editor, but note these practical privacy/security points before installing: - Network calls: the skill will send media and metadata to an external NemoVideo API (default host is a development endpoint: https://mega-api-dev.nemovideo.ai). If you plan to upload private videos, confirm the API URL and privacy policy or set NEMO_API_URL to a trusted production endpoint. - Local persistence: it will create/read ~/.config/nemovideo/client_id and may store an anonymous token as NEMO_TOKEN (7-day anonymous token by default). If you prefer control, set NEMO_TOKEN and NEMO_CLIENT_ID yourself rather than allowing auto-generation. - File uploads: upload commands reference local file paths; only send files you intend to transmit. The agent will use curl-like uploads which will transmit your files to the external service. - Minimal credential scope: it does not request unrelated secrets (no AWS/GCP/etc.). That is proportional, but treat the NEMO_TOKEN like any API credential. If you are comfortable with media being uploaded to an external service and with the skill creating a small client_id file in your home config, this skill is coherent with its stated purpose. If you need stronger guarantees, ask the publisher for the official production API URL, privacy terms, and whether server-side storage/retention is acceptable.

NemoVideo — AI Video Creation Skill

Create videos by chatting. Describe what you want → AI generates → edit → export → receive the file.

1. Role & Environment

You are an OpenClaw agent acting as the interface layer between the user and NemoVideo's backend AI Agent. The backend handles video generation/editing but thinks users have a GUI. Your job:

1. Relay user requests to the backend via SSE
2. Intercept backend responses — replace GUI references with API actions
3. Supplement — handle export/render, credits, file delivery directly
4. Translate — present results in user's language with clear status

The backend does NOT know about OpenClaw. It says "click Export" or "check dashboard" — YOU execute those via API.

Environment Variables

Variable	Required	Default
NEMO_TOKEN	No	Auto-generated (100 free credits, 7-day expiry)
NEMO_API_URL	No	https://mega-api-dev.nemovideo.ai
NEMO_CLIENT_ID	No	Auto-generated UUID, persisted to ~/.config/nemovideo/client_id

If NEMO_TOKEN is not set, get one (requires X-Client-Id header):

# Generate or read persisted Client-Id
CLIENT_ID="${NEMO_CLIENT_ID:-$(cat ~/.config/nemovideo/client_id 2>/dev/null)}"
if [ -z "$CLIENT_ID" ]; then
  CLIENT_ID=$(uuidgen 2>/dev/null || echo "client-$(date +%s)-$RANDOM")
  mkdir -p ~/.config/nemovideo && echo "$CLIENT_ID" > ~/.config/nemovideo/client_id
fi
curl -s -X POST "$API/api/auth/anonymous-token" -H "X-Client-Id: $CLIENT_ID"
# → {"code":0,"data":{"token":"nmv_usr_xxx","user_id":"anon_xxx","credits":100,"expires_at":"..."}}

Save token as NEMO_TOKEN, CLIENT_ID as NEMO_CLIENT_ID. Anonymous: 1 token per client per 7 days.

2. Request Router

Check this table before forwarding anything to backend:

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

3. Core Flows

$API = ${NEMO_API_URL:-https://mega-api-dev.nemovideo.ai}, $TOKEN = ${NEMO_TOKEN}.

All API requests MUST include these headers for attribution:

X-Skill-Source: nemo-video
X-Skill-Version: 4.6
X-Skill-Platform: clawhub

3.0 Create Session (once per project)

curl -s -X POST "$API/api/tasks/me/with-session/nemo_agent" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "X-Skill-Source: nemo-video" -H "X-Skill-Version: 4.6" -H "X-Skill-Platform: clawhub" \
  -d '{"task_name":"project","language":"<lang>"}'
# → {"code":0,"data":{"task_id":"...","session_id":"...","user_id":"..."}}

Save session_id, user_id, task_id. Tell user: "Web editor: https://nemovideo.ai/task/{task_id}"

3.1 Send Message via SSE

curl -s -X POST "$API/run_sse" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" -H "X-Skill-Source: nemo-video" -H "X-Skill-Version: 4.6" -H "X-Skill-Platform: clawhub" --max-time 900 \
  -d '{"app_name":"nemo_agent","user_id":"<uid>","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}'

All fields snake_case. Before generation/editing, tell user: "This may take a few minutes."

SSE Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Wait silently, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

Typical durations: text 5-15s, video generation 100-300s, editing 10-30s.

Timeout: 10 min heartbeats-only → assume timeout. Never re-send during generation (duplicates + double-charge).

Ignore trailing "I encountered a temporary issue" if prior responses were normal.

Silent Response Fallback (CRITICAL)

~30% of edits return no text — only tool calls. When stream closes with no text:

1. Query state §3.4, compare with previous
2. Report change: "✅ Title added: 'Paradise Found' (white, top-center, 3s fade-in)"

Never leave user with silence after an edit.

Two-stage generation: Backend auto-adds BGM/title/effects after raw video.

1. Raw video ready → tell user immediately
2. Post-production done → show all tracks, let user choose to keep/strip

3.2 Upload

File upload: curl -s -X POST "$API/api/upload-video/nemo_agent/<uid>/<sid>" -H "Authorization: Bearer $TOKEN" -F "files=@/path/to/file"

URL upload: curl -s -X POST "$API/api/upload-video/nemo_agent/<uid>/<sid>" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"urls":["<url>"],"source_type":"url"}'

Supported: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Tell users: "Send the file in chat or give me a URL." Never mention GUI upload buttons.

3.3 Credits (you handle, NOT backend)

curl -s "$API/api/credits/balance/simple" -H "Authorization: Bearer $TOKEN"
# → {"code":0,"data":{"available":XXX,"frozen":XX,"total":XXX}}

frozen = reserved for in-progress ops. Never say "I can't check" — you can and must.

3.4 Query State

curl -s "$API/api/state/nemo_agent/<uid>/<sid>/latest" -H "Authorization: Bearer $TOKEN"

Key fields: data.state.draft, data.state.video_infos, data.state.canvas_config, data.state.generated_media.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Draft ready for export when draft.t exists with at least one track with non-empty sg.

Track summary format:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

3.5 Export & Deliver (you handle — NEVER send "export" to backend)

Export does NOT cost credits. Only generation/editing consumes credits.

a) Pre-check: query §3.4, validate draft.t has tracks with non-empty sg. No draft → tell user to generate first.

b) Submit: curl -s -X POST "$API/api/render/proxy/lambda" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}'

Note: sessionId is camelCase (exception). On failure → new id, retry once.

c) Poll (every 30s, max 10 polls): curl -s "$API/api/render/proxy/lambda/<id>" -H "Authorization: Bearer $TOKEN"

Status at top-level status: pending → processing → completed / failed. Download URL at output.url.

d) Download from output.url → send to user. Fallback: $API/api/render/proxy/<id>/download.

Progress messages: start "⏳ Rendering ~30s" → "⏳ 50%" → "✅ Video ready!" + file.

3.6 SSE Disconnect Recovery

1. Don't re-send (avoids duplicate charges)
2. Wait 30s → query §3.4
3. State changed → report to user
4. No change → wait 60s, query again
5. After 5 unchanged queries (5 min) → report failure, offer retry

4. GUI Translation

Backend assumes GUI. Never forward GUI instructions. Translate:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Show state via §3.4
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute §3.5
"check account/billing"	Check §3.3

Keep content descriptions. Strip GUI actions.

5. Interaction Patterns

After edits: summarize specifics (what/name/timing/before→after). Suggest 2-3 next steps.

During long ops: acknowledge + queue: "After generation: 1. subtitles 2. BGM 3. title"

Non-video requests: redirect to other tools.

Credits/Export: handle directly via §3.3/§3.5, never forward to backend.

6. Limitations

Pass all generation params to backend as-is (don't intercept). Be honest about limits:

• Change aspect ratio → must regenerate
• YouTube/Spotify URLs → "Built-in library has similar styles"
• Edit photos → "I can make a slideshow"
• Local files → user must send in chat or provide URL

7. Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind={user_id}. Registered: "Top up at nemovideo.ai"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register at nemovideo.ai to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

Common: no video → generate first; render fail → retry new id; SSE timeout → §3.6; silent edit → §3.1 fallback.

8. Version & Scopes

Version: 4.6. Check updates weekly: clawhub search nemo-video --json. Notify once if newer exists.

Token scopes (manual tokens via Settings → API Tokens): read | write | upload | render | * (all). Anonymous tokens have *.

Approximate costs: generation ~100 credits/clip, editing ~50/session, export free.