Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Vue Component Generator Online

v1.0.0

Skip the learning curve of professional editing software. Describe what you want — generate a reusable Vue 3 component with props, emits, and scoped styles —...

0· 70·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for mhogan2013-9/vue-component-generator-online.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Vue Component Generator Online" (mhogan2013-9/vue-component-generator-online) from ClawHub.
Skill page: https://clawhub.ai/mhogan2013-9/vue-component-generator-online
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install vue-component-generator-online

ClawHub CLI

Package manager switcher

npx clawhub@latest install vue-component-generator-online
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description emphasize generating reusable Vue 3 components (code), but the SKILL.md details a cloud video rendering pipeline (upload MP4/MOV, SSE chat, export/poll for video URLs) and endpoints at mega-api-prod.nemovideo.ai. Requiring a NEMO_TOKEN and describing render/export endpoints is coherent for a video service but is disproportionate or at least unclear for a pure 'Vue component generator'. This mismatch could be legitimate (e.g., the service returns demo videos of components) but is not explained in the description.
Instruction Scope
The instructions require contacting remote APIs (session creation, SSE chat, uploads, exports) and sending user-provided media and text to nemovideo.ai. They do not instruct reading arbitrary local files or unrelated env vars beyond NEMO_TOKEN, but they do ask the agent to 'Save session_id' and include attribution headers. Important: the agent will transmit user content (descriptions and possibly uploaded media) to a third-party service — ensure users consent to remote processing of potentially sensitive content.
Install Mechanism
This is instruction-only with no install spec or third-party downloads, so nothing is written to disk by an installer. That lowers installation risk.
!
Credentials
The skill requires a single credential NEMO_TOKEN (declared primary credential), which matches the described API auth. However, the frontmatter metadata also references a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths — this inconsistency is unexplained. Also, the token controls rendering/credits on the remote service; providing it could allow the service to consume account credits or perform actions on the user's remote account, so users should treat it as sensitive.
Persistence & Privilege
always:false (normal). The skill instructs generating an ephemeral anonymous token if NEMO_TOKEN is absent and saving session_id for ongoing jobs; it doesn't explicitly instruct persistent system changes. Autonomous invocation is allowed (platform default). Combined with the need to call external APIs and possibly persist session IDs, the agent could continue remote jobs without further user prompts — users should be aware of remote job lifecycle and billing implications.
What to consider before installing
This skill routes user input and uploaded media to a third-party cloud API (mega-api-prod.nemovideo.ai) using a NEMO_TOKEN. Before installing or using it, consider: (1) Why does a "Vue component generator" need a video-rendering service? Ask the author for clarification or a homepage/source; (2) The NEMO_TOKEN is sensitive — it can authorize render jobs and consume credits. Prefer an ephemeral or limited token and avoid sharing other secrets; (3) User-provided text and files (videos, images) will be uploaded to a remote service — do not send confidential data unless you trust the service/privacy policy; (4) The skill metadata mentions a local config path (~/.config/nemovideo/) that wasn’t declared elsewhere — confirm whether the agent will read local files; (5) If you need stronger assurance, request the skill’s source or homepage, or ask the maintainer to explain how code generation outputs (Vue code) are returned and why video rendering endpoints are involved. Additional information that would raise confidence to high: an authoritative homepage/source, an explicit explanation tying video rendering to code generation, or example API responses and a privacy/billing statement.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

⚙️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk9774j39twnhh5xfvnag2tpydd84qv0k
70downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Getting Started

Got component requirements text to work with? Send it over and tell me what you need — I'll take care of the AI code generation.

Try saying:

  • "generate a description of a user profile card with avatar and stats into a 1080p MP4"
  • "generate a reusable Vue 3 component with props, emits, and scoped styles"
  • "generating Vue components from text descriptions without writing boilerplate for frontend developers"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Vue Component Generator Online — Generate Vue Components from Text

Send me your component requirements text and describe the result you want. The AI code generation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a description of a user profile card with avatar and stats, type "generate a reusable Vue 3 component with props, emits, and scoped styles", and you'll get a 1080p MP4 back in roughly 20-40 seconds. All rendering happens server-side.

Worth noting: more specific descriptions produce cleaner component structure and prop definitions.

Matching Input to Actions

User prompts referencing vue component generator online, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

  1. SessionPOST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
  2. Chat (SSE)POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
  3. UploadPOST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
  4. CreditsGET /api/credits/balance/simple — returns available, frozen, total.
  5. StateGET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
  6. ExportPOST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is vue-component-generator-online, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a reusable Vue 3 component with props, emits, and scoped styles" — concrete instructions get better results.

Max file size is 200MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.

Common Workflows

Quick edit: Upload → "generate a reusable Vue 3 component with props, emits, and scoped styles" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...