Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Text To Video Deepai

v1.0.0

Turn a two-sentence description of a sunset over a mountain lake into 720p AI generated video just by typing what you need. Whether it's generating short vid...

0· 62·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whitejohnk-26/text-to-video-deepai.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Text To Video Deepai" (whitejohnk-26/text-to-video-deepai) from ClawHub.
Skill page: https://clawhub.ai/whitejohnk-26/text-to-video-deepai
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install text-to-video-deepai

ClawHub CLI

Package manager switcher

npx clawhub@latest install text-to-video-deepai
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The declared purpose (text→video via a cloud API) matches the API endpoints and token use described. However the skill's frontmatter and instructions also reference reading YAML frontmatter at runtime and detecting install paths (~/.clawhub, ~/.cursor/skills/) and a config path (~/.config/nemovideo/). The registry metadata shown earlier listed no required config paths, creating an inconsistency: probing these user home/config locations is not necessary for generating video and increases the scope of access.
!
Instruction Scope
SKILL.md gives concrete runtime instructions to call mega-api-prod.nemovideo.ai endpoints (session creation, SSE, upload, render polling), which is coherent. But it also instructs the agent to: read this file's YAML frontmatter at runtime, detect the agent's install path by checking specific home directories, and (implicitly) access ~/.config/nemovideo/. Those filesystem probes go beyond normal API integration and could expose unrelated files/configs; the instructions also direct saving session tokens locally which is expected but should be scoped and documented.
Install Mechanism
No install spec or code files — instruction-only skill. This is the lowest install risk because nothing external is downloaded or written by an installer.
!
Credentials
The skill only requires a single credential (NEMO_TOKEN), which is appropriate for an API-backed video service. However the SKILL.md metadata and instructions imply probing ~/.config/nemovideo/ and other install paths (potentially reading local config files). That broadened filesystem access is disproportionate unless justified (e.g., to pick up an existing nemo config); the top-level registry metadata did not declare these config paths, creating an unexplained mismatch.
Persistence & Privilege
always is false and the skill uses normal autonomous invocation. It asks to store session_id/token for the session which is a typical, limited persistence need for API calls. There is no request for permanent platform-wide privileges or to modify other skills.
What to consider before installing
This skill mostly behaves like a normal cloud text→video integration (it calls nemovideo.ai endpoints and needs a NEMO_TOKEN). Before installing, ask the publisher to clarify two things: (1) why the skill needs to read YAML frontmatter and probe install/config paths (~/.clawhub, ~/.cursor/skills/, ~/.config/nemovideo/), and exactly which files it will access; and (2) whether any local config data (tokens, other service credentials) might be read or uploaded. If you don't trust those behaviors, do not set NEMO_TOKEN in a long-lived/global environment variable; instead rely on the anonymous-token flow for ephemeral use, or require the publisher to remove filesystem probes. Also confirm the API host (mega-api-prod.nemovideo.ai) is the legitimate service you expect, since the skill source is unknown.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97cezwbh1dfm954e0ffrzeprx85d9yn
62downloads
0stars
1versions
Updated 5d ago
v1.0.0
MIT-0

Getting Started

Ready when you are. Drop your text prompts here or describe what you want to make.

Try saying:

  • "generate a two-sentence description of a sunset over a mountain lake into a 720p MP4"
  • "generate a 10-second video clip of a futuristic city skyline at night"
  • "generating short videos from written text descriptions for content creators, marketers, students"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Text to Video DeepAI — Generate Videos from Text Prompts

Drop your text prompts in the chat and tell me what you need. I'll handle the AI video creation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a two-sentence description of a sunset over a mountain lake, ask for generate a 10-second video clip of a futuristic city skyline at night, and about 1-3 minutes later you've got a MP4 file ready to download. The whole thing runs at 720p by default.

One thing worth knowing — shorter and more specific prompts produce more accurate video results.

Matching Input to Actions

User prompts referencing text to video deepai, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: text-to-video-deepai
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a 10-second video clip of a futuristic city skyline at night" — concrete instructions get better results.

Max file size is 500MB. Stick to TXT, DOCX, PDF, plain text for the smoothest experience.

Export as MP4 for widest compatibility across platforms and devices.

Common Workflows

Quick edit: Upload → "generate a 10-second video clip of a futuristic city skyline at night" → Download MP4. Takes 1-3 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...