Video Audio

Get clean audio video ready to post, without touching a single slider. Upload your video with audio (MP4, MOV, AVI, WebM, up to 500MB), say something like "r...

Security Scan

The skill's declared purpose (cloud video/audio enhancement) matches the APIs it calls and the single credential it requests, but there are inconsistencies and minor scope-creep (filesystem path detection, a config-path declared only in the skill text, and automatic token generation against an external service) that warrant caution.

Purpose & Capability

Name/description align with the runtime instructions (upload video, call a remote rendering API). Requesting a NEMO_TOKEN credential is coherent for this service. However, the registry metadata at the top lists no required config paths while the SKILL.md frontmatter and metadata mention a config path (~/.config/nemovideo/). That mismatch should be clarified.

Instruction Scope

Instructions direct the agent to (a) generate an anonymous token by POSTing a UUID to an external endpoint if NEMO_TOKEN is absent, (b) create and persist a session_id, (c) upload user files via multipart/form-data and poll render endpoints, and (d) detect an install path to set an attribution header. Generating/storing tokens and probing install paths implies filesystem/network actions beyond simple API calls — this is reasonably related to the stated task but increases the skill's access surface and may involve reading/writing local state (and leaking inferred platform info).

Install Mechanism

Instruction-only skill with no install spec or downloaded code; this minimizes on-disk risk. All runtime behavior is via outbound HTTP to the referenced API endpoints.

Credentials

Only one credential (NEMO_TOKEN) is required, which is proportionate for a remote processing service. Caveats: SKILL.md also references a local config path (~/.config/nemovideo/) in metadata (not declared in the registry header), and the skill instructs creating an anonymous token if none is present — this will result in contacting the external service and receiving a token that the agent will treat as NEMO_TOKEN (100 credits, 7‑day expiry).

Persistence & Privilege

Skill does not request always:true and does not ask to change other skills or system-wide configs. It does instruct saving a session_id / using tokens, which is normal for session-based APIs but you should confirm where (and for how long) these values are persisted.

Scan Findings in Context

[no-regex-findings] expected: The static regex scanner had no code to analyze (instruction-only skill with a single SKILL.md). Absence of findings is not evidence of safety — the SKILL.md is the primary attack surface.

What to consider before installing

This skill looks like it does what it says (uploads a video and calls a remote API to enhance audio) and only asks for a single service token. Before installing: 1) Confirm you trust https://mega-api-prod.nemovideo.ai (uploads include your video/audio and may be stored/processed there). 2) Ask the author to resolve the metadata mismatch (registry says no config paths but SKILL.md lists ~/.config/nemovideo/). 3) Clarify where session tokens/session_id are stored and for how long (in-memory vs written to disk). 4) If you don't want persistent access, prefer supplying a short‑lived or scoped token rather than a long‑lived credential. 5) If you’re concerned about local path probing, ask whether the agent actually accesses the filesystem to detect install paths or can default to 'unknown'. These clarifications will reduce the remaining uncertainties.

Getting Started

Ready when you are. Drop your video with audio here or describe what you want to make.

Try saying:

• "enhance a 2-minute interview clip with background noise into a 1080p MP4"
• "remove background noise and boost the voice audio in my video"
• "cleaning and syncing audio tracks in videos for content creators"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Audio — Enhance and Sync Video Audio

Send me your video with audio and describe the result you want. The AI audio enhancement runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 2-minute interview clip with background noise, type "remove background noise and boost the voice audio in my video", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: shorter clips under 3 minutes process significantly faster.

Matching Input to Actions

User prompts referencing video audio, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-audio, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "remove background noise and boost the voice audio in my video" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.

Common Workflows

Quick edit: Upload → "remove background noise and boost the voice audio in my video" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.