Video Trimmer Js

Turn a 10-minute raw screen recording into 1080p trimmed video clips just by typing what you need. Whether it's cutting unwanted segments from video files in...

Security Scan

The skill's declared purpose (remote video trimming) matches the single required credential (NEMO_TOKEN) and remote API calls, but there are inconsistencies around config paths/metadata and instructions that tell the agent to auto-create and persist tokens and probe install paths — behaviors that widen its scope and deserve caution.

Purpose & Capability

The skill claims to perform cloud GPU video trimming and requires a single API credential (NEMO_TOKEN) — that is coherent. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata stated no required config paths, an inconsistency that should be resolved.

Instruction Scope

Runtime instructions direct the agent to obtain an anonymous token if NEMO_TOKEN is missing, create a session_id, upload user video files, stream SSE, poll render status, and include custom headers derived from the agent's install path. Those are expected for a remote render service, but the instructions also imply reading/writing persistent state (saving token/session_id) and probing install paths—actions outside pure 'call API' scope and not fully specified where or how to store secrets.

Install Mechanism

No install spec and no code files — the skill is instruction-only, so nothing is written to disk by an installer. That lowers supply-chain risk.

Credentials

Only one credential (NEMO_TOKEN) is requested, which is proportionate to calling the Nemovideo API. However, the skill instructs automatic creation of a 7-day anonymous token and to 'store' it; it's unclear where this token is persisted (env var, config file under ~/.config/nemovideo/, or agent storage), which affects confidentiality and lifetime of the secret.

Persistence & Privilege

The skill does not set always:true, but it instructs persisting tokens/session IDs and deriving X-Skill-Platform by inspecting install paths (e.g., ~/.clawhub/, ~/.cursor/skills/). That implies filesystem probing and token persistence that were not declared in registry metadata. Automatic creation and storage of credentials increases risk if you don't control where the secret is saved.

What to consider before installing

This skill appears to be what it says (a remote video-trimming frontend) but contains a few red flags you should consider before installing: 1) Metadata mismatch — the SKILL.md references a config directory (~/.config/nemovideo/) while registry metadata reported no config paths; ask the publisher to clarify where the skill will read/write files. 2) Token creation/persistence — the skill will auto-request an anonymous token and wants to 'store' it for later use; confirm where that token is saved and whether you prefer to supply your own NEMO_TOKEN instead of letting the skill generate one. 3) File uploads — the skill uploads your video files to mega-api-prod.nemovideo.ai; do not upload sensitive content unless you trust that remote service and its privacy/retention policies. 4) Headers/install-path probing — the skill attempts to derive an X-Skill-Platform header by inspecting install path patterns; if you are concerned about filesystem probing, request that the skill not probe or that you provide the platform value explicitly. If you decide to proceed, prefer manually provisioning NEMO_TOKEN, verify the service domain and privacy policy, and restrict uploads to non-sensitive material.

Getting Started

Share your video clips and I'll get started on AI video trimming. Or just tell me what you're thinking.

Try saying:

• "trim my video clips"
• "export 1080p MP4"
• "trim the first 30 seconds and"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Video Trimmer JS — Trim and Export Video Clips

Send me your video clips and describe the result you want. The AI video trimming runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 10-minute raw screen recording, type "trim the first 30 seconds and cut the last 2 minutes", and you'll get a 1080p MP4 back in roughly 20-40 seconds. All rendering happens server-side.

Worth noting: shorter source clips process faster and use fewer credits.

Matching Input to Actions

User prompts referencing video trimmer js, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-trimmer-js, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the first 30 seconds and cut the last 2 minutes" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across browsers and devices.

Common Workflows

Quick edit: Upload → "trim the first 30 seconds and cut the last 2 minutes" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.