Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Cartoon Maker Free

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — convert my video into an animated cartoon style with bold outlines and fla...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vcarolxhberger/video-cartoon-maker-free.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Cartoon Maker Free" (vcarolxhberger/video-cartoon-maker-free) from ClawHub.
Skill page: https://clawhub.ai/vcarolxhberger/video-cartoon-maker-free
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-cartoon-maker-free

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-cartoon-maker-free
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (convert videos to a cartoon style) aligns with using a remote API and requiring an API token (NEMO_TOKEN). However the SKILL.md includes metadata that references a local config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — this mismatch is unexplained. Also there is no homepage or known publisher site, making provenance harder to verify.
!
Instruction Scope
Instructions direct the agent to: (1) create an anonymous token if none is present, (2) save a session_id, (3) upload files via multipart (examples use local file paths like '/path'), and (4) detect installation platform by checking paths like ~/.clawhub/ or ~/.cursor/skills/. The platform-detection step implies reading the user's file system (install path detection) which is outside the core task and is not justified. The doc also says to 'save session_id' but doesn't specify where or how (in-memory vs persistent storage).
Install Mechanism
There is no install specification and no code files — the skill is instruction-only, so nothing is written to disk by an installer. This is the lowest-risk install model.
Credentials
The skill declares a single primary credential (NEMO_TOKEN), which is appropriate for a hosted video-processing API. The SKILL.md also refers to a config path in its metadata (~/ .config/nemovideo/), which was not declared in registry metadata — this inconsistency could mean the skill expects local config files or stored tokens. No other unrelated secrets are requested.
Persistence & Privilege
The skill is not marked always:true and uses normal autonomous invocation defaults. It asks the agent to obtain and retain a session_id for job tracking, which is reasonable for this use case, but it is unclear whether the token or session_id should be persisted to disk — the instructions do not explicitly request permanent system-level privileges.
What to consider before installing
What to consider before installing: - This skill will send any uploaded videos to https://mega-api-prod.nemovideo.ai; only upload content you’re comfortable sending to an external service. - It requires a NEMO_TOKEN (or will obtain an anonymous token for you). If you have concerns, use a throwaway/limited token rather than a sensitive account token. - The SKILL.md asks the agent to detect install paths (e.g., ~/.clawhub/, ~/.cursor/skills/) and references ~/.config/nemovideo/ in the skill metadata — confirm with the publisher whether the skill will read local filesystem paths and whether it will write tokens or session IDs to disk. If you don’t want local file access, ask the author to remove platform-detection and clarify persistence behavior. - There is no homepage or publisher information in the registry entry; verify the operator of mega-api-prod.nemovideo.ai and review their privacy/storage policy before use. - If you cannot verify the service operator or are uncomfortable with filesystem access or sending videos to that domain, do not enable the skill or provide long-lived credentials.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97a94dj8k63831bamjtf87kyh8595g9
81downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Send me your video clips or images and I'll handle the AI cartoon style conversion. Or just describe what you're after.

Try saying:

  • "convert a 30-second live-action phone video into a 1080p MP4"
  • "convert my video into an animated cartoon style with bold outlines and flat colors"
  • "turning live-action videos into cartoon-animated clips for content creators and social media users"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Cartoon Maker Free — Convert Videos to Cartoon Style

Drop your video clips or images in the chat and tell me what you need. I'll handle the AI cartoon style conversion on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 30-second live-action phone video, ask for convert my video into an animated cartoon style with bold outlines and flat colors, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 60 seconds produce the most consistent cartoon effects.

Matching Input to Actions

User prompts referencing video cartoon maker free, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-cartoon-maker-free, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "convert my video into an animated cartoon style with bold outlines and flat colors" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across social platforms.

Common Workflows

Quick edit: Upload → "convert my video into an animated cartoon style with bold outlines and flat colors" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...