Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Editor Freeware

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — trim the pauses, add transitions, and export as a clean MP4 — and get edit...

0· 80·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whitejohnk-26/video-editor-freeware.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Editor Freeware" (whitejohnk-26/video-editor-freeware) from ClawHub.
Skill page: https://clawhub.ai/whitejohnk-26/video-editor-freeware
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-editor-freeware

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-editor-freeware
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description (AI video editing, uploads/exports) match the API endpoints and upload/export workflows described in SKILL.md. Requiring a NEMO_TOKEN is reasonable for a hosted editing API. However, the skill's frontmatter metadata includes a required config path (~/.config/nemovideo/) while the registry metadata earlier stated no config paths — this mismatch is unexplained and inconsistent.
!
Instruction Scope
SKILL.md instructs the agent to obtain or use a NEMO_TOKEN, create sessions, accept uploads, stream SSE, poll status, and return download URLs — all within the stated purpose. But the instructions also require building attribution headers that depend on detecting the agent's install path (checking ~/.clawhub/ or ~/.cursor/skills/), which implies probing the user's filesystem/environment solely to set an attribution header. That filesystem probing is outside the minimal needs of a video-editing workflow and is not declared in the registry requirements. Additionally, the SKILL.md both marks NEMO_TOKEN as required and documents an anonymous-token POST flow (i.e., the skill can create a token itself), which contradicts the registry's claim that NEMO_TOKEN is required at install/runtime.
Install Mechanism
There is no install spec and no code files; this is instruction-only, so nothing is written to disk. That is the lowest install risk.
!
Credentials
The only declared environment secret is NEMO_TOKEN, which is appropriate for a hosted API. However: (1) SKILL.md describes creating an anonymous token if NEMO_TOKEN is missing, making the required-env claim inconsistent; (2) the YAML frontmatter lists a config path (~/.config/nemovideo/) that was not present in the registry-level requirements — implying the skill may expect to read local config files; and (3) the need to detect install paths to set attribution headers implies reading filesystem locations not justified by core editing functionality. These discrepancies increase the risk that the agent will probe for local data it doesn't need.
Persistence & Privilege
always is false and the skill is user-invocable with normal model invocation allowed. There is no install step and nothing requests permanent presence or modification of other skills or system-wide settings.
What to consider before installing
This skill looks like a plausible hosted video-editing integration, but there are inconsistencies you should clarify before installing or providing credentials: 1) Ask the maintainer why registry metadata says no config paths while the skill's frontmatter references ~/.config/nemovideo/ — will the skill read files from your home directory? 2) Confirm whether NEMO_TOKEN is truly required or optional: the SKILL.md documents an anonymous-token flow, so you don't necessarily need to set a token yourself. 3) Ask why the skill needs to detect install paths (~/.clawhub/, ~/.cursor/skills/) to build an attribution header — if the agent will probe your filesystem, request exact details of what it will read and why. 4) If you do provide a NEMO_TOKEN, prefer a scoped, low-privilege token and avoid reusing any critical account credentials. 5) Verify the service domain (mega-api-prod.nemovideo.ai) and privacy/retention policy for uploaded videos before sharing sensitive content. If the maintainer cannot explain the config-path and install-path checks, treat the skill cautiously or avoid granting filesystem access.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

✂️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97ag0excp0jwxmyre2w2d811h8591ay
80downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Getting Started

Share your raw video clips and I'll get started on AI video editing. Or just tell me what you're thinking.

Try saying:

  • "edit my raw video clips"
  • "export 1080p MP4"
  • "trim the pauses, add transitions, and"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Editor Freeware — Edit and Export Videos Free

Send me your raw video clips and describe the result you want. The AI video editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 3-minute unedited screen recording, type "trim the pauses, add transitions, and export as a clean MP4", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter clips under 2 minutes process significantly faster.

Matching Input to Actions

User prompts referencing video editor freeware, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-editor-freeware, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the pauses, add transitions, and export as a clean MP4" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across devices and platforms.

Common Workflows

Quick edit: Upload → "trim the pauses, add transitions, and export as a clean MP4" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...