Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Tiktok Video

v1.0.0

TikTok creators create raw video footage into TikTok-ready clips using this skill. Accepts MP4, MOV, AVI, WebM up to 500MB, renders on cloud GPUs at 1080p, a...

0· 91·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vynbosserman65/tiktok-video.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Tiktok Video" (vynbosserman65/tiktok-video) from ClawHub.
Skill page: https://clawhub.ai/vynbosserman65/tiktok-video
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install tiktok-video

ClawHub CLI

Package manager switcher

npx clawhub@latest install tiktok-video
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to perform cloud GPU video rendering and only requests a single service credential (NEMO_TOKEN), which matches the described functionality. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata earlier lists no required config paths — that's an internal mismatch worth clarifying (where will it store session tokens/config?).
!
Instruction Scope
The instructions direct the agent to call an external API (mega-api-prod.nemovideo.ai), create anonymous tokens if no NEMO_TOKEN is present, upload video files (local paths or URLs), save session_id, and auto-detect an install path to set X-Skill-Platform. These are expected for a remote render service, but the guidance is vague about where session data is persisted and when local paths are accessed. Auto-detecting install path may cause the agent to inspect local filesystem locations.
Install Mechanism
This is instruction-only with no install spec or code to download or run. That reduces risk compared to skills that fetch arbitrary binaries.
Credentials
Only NEMO_TOKEN is declared as required, which is proportionate for an integration with an external rendering API. The SKILL.md also documents how to obtain an anonymous token if none is present, and the frontmatter's configPaths (not declared elsewhere) suggests the skill may read/write a local config directory — this should be clarified.
Persistence & Privilege
The skill asks the agent to save session_id and may persist session state (implied config path). It is not always-enabled and does not request broad system privileges, but you should confirm where credentials/session data are stored and how long they persist.
What to consider before installing
This skill appears to be a wrapper for an external video-rendering API (mega-api-prod.nemovideo.ai). Before installing or providing files: 1) Verify the service/provider (no homepage or source is listed); 2) Decide whether you trust sending your raw videos to that external host; 3) Prefer generating and supplying your own NEMO_TOKEN rather than allowing anonymous token generation if you want tighter control; 4) Ask the developer where session_id and tokens are stored (SKILL.md mentions ~/.config/nemovideo/ in frontmatter but registry metadata did not) and whether those files are encrypted or scoped to this skill; 5) Don't install if you cannot confirm the domain's legitimacy or privacy policy. If you want to proceed, limit the content you upload (no sensitive videos) and consider revoking any tokens after use.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97cjmskgh8x08bknths32qfr584j9f3
91downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Getting Started

Share your raw video footage and I'll get started on AI short-form editing. Or just tell me what you're thinking.

Try saying:

  • "create my raw video footage"
  • "export 1080p MP4"
  • "cut to 60 seconds, add trending"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

TikTok Video — Create and Export TikTok Clips

This tool takes your raw video footage and runs AI short-form editing through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 3-minute phone recording of a dance or skit and want to cut to 60 seconds, add trending captions, and sync to beat — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: vertical 9:16 footage processes best and avoids cropping issues on TikTok.

Matching Input to Actions

User prompts referencing tiktok video, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcetiktok-video
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "cut to 60 seconds, add trending captions, and sync to beat" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for smooth TikTok uploads.

Common Workflows

Quick edit: Upload → "cut to 60 seconds, add trending captions, and sync to beat" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...