Video Maker From Photos

Turn ten vacation photos from a beach trip into 1080p compiled photo video just by typing what you need. Whether it's turning photo collections into shareabl...

Security Scan

The skill's requests and runtime instructions are consistent with its stated purpose (upload photos, create server-side videos) and there are no disproportionate credentials or risky install steps.

Purpose & Capability

Name/description map to the actions in SKILL.md: creating server-side videos from uploaded photos. The only required secret is NEMO_TOKEN which is appropriate. Minor inconsistency: the registry summary listed no required config paths, but the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/). That path is not referenced elsewhere in the instructions, so clarify whether the skill needs filesystem access to that config directory.

Instruction Scope

Instructions stay within the service integration: obtain/use NEMO_TOKEN, create a session, upload files, stream SSE events, and poll renders. They do ask the agent to read this file's YAML frontmatter at runtime and to detect install paths (~/.clawhub, ~/.cursor/skills/) to populate attribution headers — this requires limited filesystem access. The skill also expects file uploads from the user (multipart or file paths), which legitimately needs access to the user's files. No instructions request unrelated system files, shell history, or other credentials.

Install Mechanism

No install spec and no code files — the skill is instruction-only, so nothing is downloaded or written to disk by an installer.

Credentials

Only one environment variable is requested (NEMO_TOKEN) and it's the primary credential used to call the described API. The skill also describes a flow to obtain an anonymous token if none is present, which is consistent with its function. No unrelated secrets are requested.

Persistence & Privilege

always:false and no instructions to persist system-wide settings or modify other skills. Autonomous invocation is allowed (platform default) but the skill does not request elevated or persistent privileges.

Assessment

This skill appears to do what it says: it uploads photos to mega-api-prod.nemovideo.ai and creates server-side video renders. Before installing, consider: (1) It will send your image files to an external service — do not upload sensitive images you don't want transmitted. (2) The skill may read its own SKILL.md and detect installation paths (it may check locations like ~/.clawhub or ~/.cursor/skills/) to populate attribution headers; if you are uncomfortable with the agent accessing those paths, avoid installing. (3) Confirm whether the documented config path (~/.config/nemovideo/) is actually needed, since the registry summary omitted it; if it is required, that could allow reading a local Nemovideo config. (4) NEMO_TOKEN is the only secret required — only provide a token you trust. Overall this is internally coherent, but review the data you plan to upload and the token you provide.

Getting Started

Share your photos and images and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

• "turn my photos and images"
• "export 1080p MP4"
• "turn my photos into a 30-second"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

• Generate a UUID as client identifier
• POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
• The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Video Maker from Photos — Turn Photos into Videos

Send me your photos and images and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload ten vacation photos from a beach trip, type "turn my photos into a 30-second slideshow video with music and transitions", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: using 10-20 photos gives the best pacing for a short video.

Matching Input to Actions

User prompts referencing video maker from photos, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Skill attribution — read from this file's YAML frontmatter at runtime:

• X-Skill-Source: video-maker-from-photos
• X-Skill-Version: from frontmatter version
• X-Skill-Platform: detect from install path (~/.clawhub/ → clawhub, ~/.cursor/skills/ → cursor, else unknown)

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "turn my photos into a 30-second slideshow video with music and transitions" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn my photos into a 30-second slideshow video with music and transitions" — concrete instructions get better results.

Max file size is 200MB. Stick to JPG, PNG, HEIC, WEBP for the smoothest experience.

Export as MP4 for widest compatibility across all platforms.