Pictory Ai

Skip the learning curve of professional editing software. Describe what you want — convert this blog post into a short branded video with captions and backgr...

Security Scan

The skill's requests and runtime instructions are consistent with a cloud video-rendering integration (it only needs a NEMO_TOKEN and uploads user files to nemovideo.ai), but there are small metadata inconsistencies and privacy implications you should be aware of before using it.

Purpose & Capability

Name/description (convert text/video to shareable videos) match the declared environment requirement (NEMO_TOKEN) and the SKILL.md instructions which call nemovideo.ai render/upload/credits APIs. No unrelated cloud providers or unrelated credentials are requested.

Instruction Scope

Instructions are focused on session creation, SSE-based message streaming, file upload, and export polling — all expected for a cloud render pipeline. They explicitly tell the agent to use NEMO_TOKEN if present or request an anonymous token, and to upload user files (up to 500MB). That implies the agent will send user data to an external service (mega-api-prod.nemovideo.ai); this is expected but has privacy implications. The SKILL.md also instructs detecting install path to set X-Skill-Platform headers (reading local paths), which is not necessary for core functionality and can leak local path information.

Install Mechanism

Instruction-only skill (no install spec, no code files). This is the lowest install risk: nothing is written to disk by an installer. All runtime behavior comes from the SKILL.md instructions.

Credentials

Only one credential is declared (NEMO_TOKEN) which aligns with the service's bearer-token auth model. However, the SKILL.md's YAML frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata reported no required config paths — an inconsistency worth clarifying. The skill will use any NEMO_TOKEN found in the environment (or obtain an anonymous token) and will include headers derived from local install paths, which could expose local path info.

Persistence & Privilege

No elevated privileges requested. always is false. The skill is user-invocable and may be invoked autonomously per platform default, which is normal. It does not request to modify other skills or system-wide settings.

Assessment

This skill appears to do what it says — it will upload files you give it to a nemovideo.ai backend and use NEMO_TOKEN (or obtain an anonymous token) to render videos. Before installing or using it: 1) Be aware that any files (including potentially sensitive content) will be uploaded to https://mega-api-prod.nemovideo.ai — only use it for content you are comfortable sending to a third party. 2) Confirm the domain and service are legitimate and that you trust them; if unsure, use anonymous/free token or a throwaway account rather than a long-lived production token. 3) Note the metadata inconsistency: the registry lists no config paths but the SKILL.md mentions ~/.config/nemovideo/ — ask the publisher to clarify. 4) The skill may read install path information to set headers (could reveal local path info); if that concerns you, request a version that omits that behavior. 5) Because this is instruction-only with no code files, there's limited static analysis — if you need a higher assurance level, ask the publisher for a provenance statement or official documentation for the API endpoints and token handling.

Getting Started

Got text or video to work with? Send it over and tell me what you need — I'll take care of the AI video creation.

Try saying:

• "convert a 1,200-word blog post article into a 1080p MP4"
• "convert this blog post into a short branded video with captions and background clips"
• "turning blog posts or scripts into short shareable videos for marketers and content creators"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

• Generate a UUID as client identifier
• POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
• The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Pictory AI — Turn Text Into Shareable Videos

This tool takes your text or video and runs AI video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 1,200-word blog post article and want to convert this blog post into a short branded video with captions and background clips — the backend processes it in about 1-3 minutes and hands you a 1080p MP4.

Tip: shorter scripts under 500 words produce tighter, more focused video output.

Matching Input to Actions

User prompts referencing pictory ai, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is pictory-ai, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "convert this blog post into a short branded video with captions and background clips" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, TXT, DOCX for the smoothest experience.

Export as MP4 for widest compatibility across social and web platforms.

Common Workflows

Quick edit: Upload → "convert this blog post into a short branded video with captions and background clips" → Download MP4. Takes 1-3 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.