Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Editing With Lightroom

v1.0.0

edit video clips into color graded videos with this skill. Works with MP4, MOV, AVI, MKV files up to 500MB. photographers and content creators use it for app...

0· 95·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mhogan2013-9/video-editing-with-lightroom.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Editing With Lightroom" (mhogan2013-9/video-editing-with-lightroom) from ClawHub.
Skill page: https://clawhub.ai/mhogan2013-9/video-editing-with-lightroom
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-editing-with-lightroom

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-editing-with-lightroom
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill claims to perform cloud video color grading and only requires a single credential (NEMO_TOKEN), which is consistent with calling an external processing API. However the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata said no config paths are required — this inconsistency is unexplained and could indicate the skill expects local config access.
Instruction Scope
Instructions are explicit about uploading user video files to https://mega-api-prod.nemovideo.ai, creating sessions, and polling SSE streams — all within the stated purpose. They instruct generating an anonymous token via a POST and storing/using NEMO_TOKEN. They do not direct reading unrelated system files, but the frontmatter's config path and the requirement to auto-detect X-Skill-Platform from an install path imply the agent may inspect install/config paths. The skill will transmit user media and metadata to an external service — users should be aware of privacy implications.
Install Mechanism
This is instruction-only with no install spec or code files, so nothing is written to disk by an installer. That minimizes supply-chain risk.
Credentials
Only NEMO_TOKEN is declared (primaryEnv) which is proportionate for calling the remote API. But the SKILL.md frontmatter's configPaths entry (which isn't reflected in the registry's required config paths) suggests possible access to ~/.config/nemovideo/ — it's unclear whether the skill will read/write that path or persist tokens there. The skill also instructs generating and storing an anonymous token; how/where it is stored is not specified.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request elevated platform privileges. Autonomous invocation is allowed (platform default) but is not combined here with other high-risk indicators.
What to consider before installing
This skill sends your video files (and session/auth tokens) to an external service (mega-api-prod.nemovideo.ai). That aligns with its editing purpose but consider privacy: do not upload sensitive footage unless you trust the service. The SKILL.md asks for a NEMO_TOKEN (it can generate an anonymous token) and references a local config path (~/.config/nemovideo/) even though the registry metadata did not — ask the publisher where tokens and session IDs are stored and whether the skill reads local config. Because the skill's source and homepage are unknown, prefer caution: (1) avoid uploading private or regulated content, (2) ask the publisher for a privacy/data-retention statement and clarification about the configPath, and (3) if you must use it, prefer ephemeral anonymous tokens and delete any stored tokens or session files after use. If you want, I can produce exact questions to ask the publisher or a checklist to review before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎨 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97bg799yh8884kapmgcyc9e9h8587cr
95downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Share your video clips and I'll get started on color grading editing. Or just tell me what you're thinking.

Try saying:

  • "edit my video clips"
  • "export 1080p MP4"
  • "apply Lightroom-style color grading and adjust"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Editing with Lightroom — Color Grade and Export Videos

Drop your video clips in the chat and tell me what you need. I'll handle the color grading editing on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 2-minute travel video shot on iPhone, ask for apply Lightroom-style color grading and adjust exposure, contrast, and saturation across the clip, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 60 seconds process significantly faster and allow quicker color grade previews.

Matching Input to Actions

User prompts referencing video editing with lightroom, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

EndpointMethodPurpose
/api/tasks/me/with-session/nemo_agentPOSTStart a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_ssePOSTSend a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>POSTUpload a file (multipart) or URL.
/api/credits/balance/simpleGETCheck remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latestGETFetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambdaPOSTStart export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcevideo-editing-with-lightroom
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "apply Lightroom-style color grading and adjust exposure, contrast, and saturation across the clip" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "apply Lightroom-style color grading and adjust exposure, contrast, and saturation across the clip" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, MKV for the smoothest experience.

Export as MP4 with H.264 codec for the best balance of color accuracy and file size.

Comments

Loading comments...