Wechat Video Online

Skip the learning curve of professional editing software. Describe what you want — trim the video, add subtitles, and export for sharing on WeChat — and get...

Security Scan

The skill's declared purpose (online WeChat-friendly video editing) broadly matches its runtime instructions, but there are inconsistencies around declared config paths, how/where session tokens get stored, and automatic network/auth flows that warrant caution.

Purpose & Capability

Name and description match the actions described in SKILL.md: remote GPU rendering, uploads, exports. Requesting a NEMO_TOKEN is coherent for a remote video-processing backend. However, the SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — this inconsistency should be clarified.

Instruction Scope

The instructions instruct the agent to automatically obtain an anonymous token (POST to https://mega-api-prod.nemovideo.ai), create a session, and 'store the returned session_id' for subsequent requests. They also instruct detecting install paths (e.g., ~/.clawhub, ~/.cursor/skills) to set attribution headers. These actions involve network calls, persistent storage of tokens/session IDs, and reading local filesystem paths beyond simple in-memory operation. The SKILL.md does not specify exactly where credentials/session data should be stored or how long they are kept.

Install Mechanism

No install spec or code files — instruction-only skill — so there is no package download or archive extraction. This minimizes installation-time risk.

Credentials

Only NEMO_TOKEN is declared as required, which is reasonable for a cloud service. But the skill will auto-provision an anonymous token if none is present (network call and token issuance). The SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) that is not listed in the registry metadata; this mismatch is unexplained. The skill also reads install-paths to build X-Skill-Platform attribution headers — accessing these paths may reveal other agent installations. Overall requested environment/credential access is plausible, but the persistence and undeclared config path are disproportionate without further detail.

Persistence & Privilege

always is false (normal) and autonomous invocation is allowed (platform default). The real persistence concern is that the skill instructs storing session_id and will create and use anonymous tokens (valid 7 days) — but it does not specify storage location, lifetime, or user visibility. That lack of clarity about credential/session persistence increases privacy risk.

What to consider before installing

This skill appears to do what it says (upload your video to a remote service and return an edited MP4), but it will contact https://mega-api-prod.nemovideo.ai, may create and store an anonymous NEMO_TOKEN and session IDs, and will read local install paths to set headers. Before installing or using it: (1) confirm you trust nemovideo.ai and are comfortable uploading videos (they will leave your machine); (2) prefer supplying your own NEMO_TOKEN rather than letting the skill auto-generate/store one; (3) ask the author or registry for clarity on where tokens/session IDs are stored and how long they persist; (4) note the registry metadata/frontmatter mismatch (~/.config/nemovideo/ listed in SKILL.md but not in registry) — verify whether the skill will create or read that directory; and (5) because the skill owner and homepage are unknown, exercise extra caution with sensitive or private video content.

Getting Started

Got video clips to work with? Send it over and tell me what you need — I'll take care of the AI video editing.

Try saying:

• "edit a 60-second WeChat video recording into a 1080p MP4"
• "trim the video, add subtitles, and export for sharing on WeChat"
• "editing and preparing videos for WeChat sharing for WeChat users and content creators"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

WeChat Video Online — Edit and Export WeChat Videos

Send me your video clips and describe the result you want. The AI video editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 60-second WeChat video recording, type "trim the video, add subtitles, and export for sharing on WeChat", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: keep videos under 2 minutes for faster processing and easier WeChat sharing.

Matching Input to Actions

User prompts referencing wechat video online, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Skill attribution — read from this file's YAML frontmatter at runtime:

• X-Skill-Source: wechat-video-online
• X-Skill-Version: from frontmatter version
• X-Skill-Platform: detect from install path (~/.clawhub/ → clawhub, ~/.cursor/skills/ → cursor, else unknown)

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "trim the video, add subtitles, and export for sharing on WeChat" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the video, add subtitles, and export for sharing on WeChat" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for best compatibility with WeChat playback.