Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Green Screen Video Maker Free

v1.0.0

replace video clips into background-replaced videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. YouTubers, TikTok creators, streamers...

0· 37·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill name/description (cloud-based green screen removal, exports) matches the runtime instructions that call a remote rendering API and require an API token. Requesting NEMO_TOKEN is coherent. However the SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) that the registry summary did not list — this is unexpected for a simple API-only integration and is worth questioning.
!
Instruction Scope
Instructions are specific about API calls, session creation, SSE handling, uploading user-supplied files, and using Authorization headers — all reasonable for a cloud video service. But they also say to auto-detect X-Skill-Platform from an 'install path' (which may require reading filesystem/install metadata) and reference the config path in frontmatter. Those elements expand the agent's runtime scope beyond purely forwarding user files to the API and should be clarified.
Install Mechanism
No install spec and no code files are present (instruction-only). That reduces disk-write risk—nothing will be downloaded or installed by the skill itself.
!
Credentials
Only one credential (NEMO_TOKEN) is required, which matches the described API usage. However the SKILL.md also declares access to a config path (~/.config/nemovideo/) in frontmatter — this was not surfaced by the registry metadata. Asking for a config directory (even if trivial) increases the scope of access versus the simple API token and is disproportionate unless justified.
Persistence & Privilege
The skill is not always-enabled and does not request any special persistent privileges. It does instruct keeping and using session tokens for API calls, which is normal for this kind of service.
What to consider before installing
This skill appears to implement a legitimate cloud green‑screen service, but two things to check before installing: (1) confirm the origin and reputation of the API host (mega-api-prod.nemovideo.ai) and the skill author, since the source/homepage are unknown; (2) ask whether the skill actually needs access to ~/.config/nemovideo/ and whether the agent will read any other local paths (the SKILL.md mentions auto-detecting the install path). Only provide your NEMO_TOKEN if you trust the service; do not supply unrelated credentials. If possible, run the skill in a sandboxed environment or review network logs for unexpected endpoints when first using it.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🟩 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk971y0kjs97h34mfen9dvt6mhx85apj6
37downloads
0stars
1versions
Updated 22h ago
v1.0.0
MIT-0

Getting Started

Share your video clips and I'll get started on green screen removal. Or just tell me what you're thinking.

Try saying:

  • "replace my video clips"
  • "export 1080p MP4"
  • "remove the green screen and replace"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

Green Screen Video Maker Free — Remove Backgrounds and Export Videos

Drop your video clips in the chat and tell me what you need. I'll handle the green screen removal on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 30-second clip filmed in front of a green backdrop, ask for remove the green screen and replace the background with a city skyline, and about 30-60 seconds later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — well-lit, evenly colored green screens produce the cleanest key with no fringing.

Matching Input to Actions

User prompts referencing green screen video maker free, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcegreen-screen-video-maker-free
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "remove the green screen and replace the background with a city skyline" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "remove the green screen and replace the background with a city skyline" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for the best balance of quality and file size.

Comments

Loading comments...