Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Compressor Download

v1.0.0

Turn a 500MB 1080p MP4 recording into 1080p compressed MP4 files just by typing what you need. Whether it's reducing video file size for sharing or uploading...

0· 42·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and instructions match a remote video-compression service and the single required env var (NEMO_TOKEN) is consistent with that. However, the SKILL.md metadata declares a config path (~/.config/nemovideo/) while registry metadata lists no required config paths — an inconsistency. Source and homepage are also missing, reducing provenance.
!
Instruction Scope
Runtime instructions direct the agent to POST user video files and metadata to https://mega-api-prod.nemovideo.ai (expected for a cloud render service), obtain anonymous tokens, save session IDs, and include attribution headers derived from the SKILL.md frontmatter and the agent's install path. That implies reading local install/config information and transmitting user videos and derived headers to a third-party service. The instructions do not describe secure storage or limits on what is uploaded.
Install Mechanism
No install spec or code files — this is instruction-only, so nothing will be downloaded or installed by the skill itself (lowest install risk).
Credentials
Only a single credential (NEMO_TOKEN) is required, which is proportional to a remote-rendering API. But the SKILL.md metadata includes a config path (~/.config/nemovideo/) and asks the agent to detect install path for headers, which would require local filesystem access; that access is not reflected in the registry metadata and could be disproportionate depending on what lives in those paths.
Persistence & Privilege
always is false and the skill does not request system-wide modifications. It instructs saving session_id and tokens in-session (normal), but does not request permanent elevated privileges.
What to consider before installing
This skill will upload your video files and related metadata to a third-party API (mega-api-prod.nemovideo.ai). Before using it: 1) Only try with non-sensitive test videos until you confirm behavior and retention policy. 2) Verify the service/domain and publisher (there's no homepage/source listed). 3) Prefer using an anonymous/test NEMO_TOKEN and avoid reusing credentials tied to other accounts. 4) Ask the publisher to explain why SKILL.md lists a config path (~/.config/nemovideo/) while the registry metadata does not, and whether the agent will read local install paths or config files. 5) If you can't verify provenance or data retention/privacy terms, do not upload private content. If you want, I can draft questions to ask the publisher or suggest safer alternatives.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🗜️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk974g9zds2h2ff442p31dbw41n84x94g
42downloads
0stars
1versions
Updated 3d ago
v1.0.0
MIT-0

Getting Started

Share your large video files and I'll get started on AI video compression. Or just tell me what you're thinking.

Try saying:

  • "compress my large video files"
  • "export 1080p MP4"
  • "compress this video to under 50MB"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Compressor Download — Compress and Download Smaller Videos

Send me your large video files and describe the result you want. The AI video compression runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 500MB 1080p MP4 recording, type "compress this video to under 50MB without losing quality", and you'll get a 1080p MP4 back in roughly 20-60 seconds. All rendering happens server-side.

Worth noting: shorter clips compress faster — split long videos before uploading for quicker results.

Matching Input to Actions

User prompts referencing video compressor download, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-compressor-download, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "compress this video to under 50MB without losing quality" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

H.264 codec gives the best balance of quality and file size for compressed output.

Common Workflows

Quick edit: Upload → "compress this video to under 50MB without losing quality" → Download MP4. Takes 20-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...