Text To Video By Canva

Get text-based videos ready to post, without touching a single slider. Upload your text prompts (TXT, DOCX, PDF, copied text, up to 200MB), say something lik...

Security Scan

The skill appears to implement text→video by calling nemovideo.ai, but its name, declared requirements, and metadata contain inconsistencies and provenance gaps; it will upload user files and may leak environment/installation information, so review before installing.

Purpose & Capability

The skill is named 'Text To Video By Canva' but all runtime endpoints point to mega-api-prod.nemovideo.ai and there is no homepage or source provenance. The declared primary credential (NEMO_TOKEN) is consistent with the API, but the mismatch between the Canva branding and the actual API host plus missing publisher information is a red flag for origin/legitimacy. The SKILL.md metadata also lists a config path (~/.config/nemovideo/) even though the registry shows 'required config paths: none' — this inconsistency suggests sloppy or conflicting configuration.

Instruction Scope

Instructions will upload user-provided files (multipart upload or URL) and create sessions/tokens on a third-party backend; they instruct the agent to check NEMO_TOKEN and, if missing, obtain an anonymous token via an API call. The skill also specifies headers derived from the agent's install path (X-Skill-Platform), which could reveal environment/installation details. Overall the actions are consistent with a cloud-render service, but the instructions permit automatic token creation and reference local config paths — both broaden the agent's runtime behavior beyond a simple conversion tool.

Install Mechanism

No install specification or code files are present; this is instruction-only, which reduces disk-write risk. There is no download/extract/install of third-party binaries described.

Credentials

Only one environment variable (NEMO_TOKEN) is declared, which is appropriate for an API-backed service. However the SKILL.md states that if NEMO_TOKEN is missing the agent should obtain an 'anonymous' token by calling the API — yet the registry listed NEMO_TOKEN as required. That conflict (required vs optional) is incoherent. The metadata's config path (~/.config/nemovideo/) is also present in the SKILL.md, which could result in reading local configuration/config files not declared in the registry. The skill also requires inclusion of attribution headers that may leak install-path-derived info.

Persistence & Privilege

The skill is not set to always:true and uses default autonomous invocation settings (normal). There is no install-time persistent agent modification described. However, the skill's header rules (X-Skill-Platform derived from install path) could cause the agent to expose its installation path; this is a privacy consideration rather than a privilege escalation.

What to consider before installing

This skill will send your text and any uploaded files to a third-party backend (mega-api-prod.nemovideo.ai). Before installing: 1) Verify the publisher/source — the skill claims 'By Canva' but the API host is 'nemovideo.ai' and no homepage/source is provided. 2) Do not upload sensitive or private files unless you trust the service and its privacy terms. 3) Prefer creating a scoped, low-privilege NEMO_TOKEN (or review what the anonymous token grants) rather than supplying a long-lived credential. 4) Ask the publisher why the registry lists NEMO_TOKEN as required when the SKILL.md describes creating an anonymous token and why a config path (~/.config/nemovideo/) appears in metadata. 5) Consider refusing installation if provenance cannot be confirmed or if you cannot accept that the agent will transmit files and environment/installation metadata to the nemovideo.ai service.

Getting Started

Ready when you are. Drop your text prompts here or describe what you want to make.

Try saying:

• "convert a 100-word product description into a 1080p MP4"
• "turn this blog post intro into a 30-second video with visuals and music"
• "turning written content into shareable social videos for marketers"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Text to Video by Canva — Convert Text into Shareable Videos

This tool takes your text prompts and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 100-word product description and want to turn this blog post intro into a 30-second video with visuals and music — the backend processes it in about 1-2 minutes and hands you a 1080p MP4.

Tip: shorter text inputs produce tighter, more focused videos.

Matching Input to Actions

User prompts referencing text to video by canva, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is text-to-video-by-canva, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn this blog post intro into a 30-second video with visuals and music" — concrete instructions get better results.

Max file size is 200MB. Stick to TXT, DOCX, PDF, copied text for the smoothest experience.

Export as MP4 for widest compatibility across social platforms.

Common Workflows

Quick edit: Upload → "turn this blog post intro into a 30-second video with visuals and music" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.