Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Generator Ki Free

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — generate a 30-second video from my product description for free — and get...

0· 74·0 current·0 all-time
bypeandrover adam@peand-rover

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for peand-rover/video-generator-ki-free.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Generator Ki Free" (peand-rover/video-generator-ki-free) from ClawHub.
Skill page: https://clawhub.ai/peand-rover/video-generator-ki-free
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-generator-ki-free

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-generator-ki-free
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (AI video generator) matches the runtime instructions: uploading media, creating sessions, SSE for generation, and exporting MP4s. Requested primary credential NEMO_TOKEN is proportional for an API-backed service. However, SKILL.md frontmatter declares a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — this metadata mismatch is inconsistent and unexplained. The skill also asks the agent to detect install path (~/.clawhub/ or ~/.cursor/skills/) to fill an attribution header, which is plausible but broadens filesystem access beyond strictly 'send me media'.
!
Instruction Scope
Instructions include creating sessions, uploading potentially large user files (up to 200MB), polling state, SSE handling, and always including Authorization and attribution headers. Those actions are coherent with a cloud-render workflow. Concerning points: the instructions direct reading this skill's YAML frontmatter and detecting agent install paths on disk (probing ~ and specific directories) — this requires filesystem access and could reveal other environment details. The SKILL.md also instructs the agent to 'keep technical details out of the chat' which is operational guidance but not a security issue by itself. No unrelated environment variables are requested in registry data, and instructions do not request additional credentials beyond NEMO_TOKEN, but filesystem probing and automatic uploads of user files to an external domain increase privacy risk.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low risk from an installation perspective because nothing is written to disk by the skill itself. The runtime behavior still involves network calls, but there is no package download or archive extraction to review.
Credentials
Only NEMO_TOKEN is declared as required and is the primary credential — that is proportionate for an API-backed video service. The SKILL.md includes logic to generate an anonymous token if NEMO_TOKEN is absent (POST to the provider) which is reasonable but means tokens may be minted transparently. The earlier-mentioned mismatch about a declared config path (~/.config/nemovideo/) in the frontmatter is unexplained by the registry metadata and could imply the skill might read local config files if present.
Persistence & Privilege
always:false (default) and disable-model-invocation:false — normal settings. The skill does not request persistent presence or claim to modify other skills or global agent settings. No indicators of elevating privileges or self-enabling behavior in the provided instructions.
What to consider before installing
What to consider before installing: - Trust the remote service: this skill uploads your files (images/video/audio) to https://mega-api-prod.nemovideo.ai; only use it for media you are comfortable sending to that domain. - Token scope: NEMO_TOKEN is the API credential — treat it like a password. If you provide your token, the skill can act as you (create sessions, render jobs, consume credits). Use an API key with limited scope or an ephemeral token where possible. - Anonymous token behavior: if you don't provide a token the skill will POST to the provider to obtain a free anonymous token — this is convenient but means the provider can still receive your uploads. - Filesystem probing: the skill instructs reading its own frontmatter and detecting install paths (~/.clawhub, ~/.cursor/skills). That requires filesystem access; avoid installing if you don't want a skill that may inspect local paths. - Metadata mismatch: frontmatter lists a config path (~/.config/nemovideo/) not declared in the registry metadata — ask the publisher why and whether any local config will be read. - No source/homepage: the skill has no homepage or published source; if you need accountability or audits, prefer skills with a clear origin. Recommendations: verify the service domain and privacy policy, prefer ephemeral or limited-scope tokens, avoid sending sensitive files, and ask the publisher to explain the configPath and install-path checks before trusting the skill with account credentials or private media.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk974zhdkj8jytzsvtm97k715nx85b0j3
74downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Getting Started

Ready when you are. Drop your text or images here or describe what you want to make.

Try saying:

  • "generate a short text description or three product photos into a 1080p MP4"
  • "generate a 30-second video from my product description for free"
  • "generating videos from text or images for free for students and social media creators"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Video Generator Ki Free — Generate Videos Free with AI

Send me your text or images and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a short text description or three product photos, type "generate a 30-second video from my product description for free", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter text prompts tend to produce more focused and faster results.

Matching Input to Actions

User prompts referencing video generator ki free, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Skill attribution — read from this file's YAML frontmatter at runtime:

  • X-Skill-Source: video-generator-ki-free
  • X-Skill-Version: from frontmatter version
  • X-Skill-Platform: detect from install path (~/.clawhub/clawhub, ~/.cursor/skills/cursor, else unknown)

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a 30-second video from my product description for free" — concrete instructions get better results.

Max file size is 200MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across all platforms.

Common Workflows

Quick edit: Upload → "generate a 30-second video from my product description for free" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...