Image To Video Oi

Turn three product photos in JPG format into 1080p animated image videos just by typing what you need. Whether it's converting still images into shareable vi...

Security Scan

The skill mostly matches its stated purpose (upload images and call a cloud render API) but contains inconsistencies and a few instructions that broaden its scope (creating/persisting tokens, probing install paths, and instructions that could cause arbitrary local files to be uploaded) that warrant caution.

Purpose & Capability

Name/description align with using a remote render API and the single required credential (NEMO_TOKEN) is appropriate. However the SKILL.md's YAML metadata claims a config path (~/.config/nemovideo/) while the registry metadata listed no config paths — an internal inconsistency. Also the skill adds headers derived from the agent install path (checking ~/.clawhub/ and ~/.cursor/skills/), which is not needed to perform image→video conversion and expands the scope of what the skill reads from the host.

Instruction Scope

Instructions tell the agent to auto-request an anonymous token and store it as NEMO_TOKEN, create and persist a session_id, infer install path to set X-Skill-Platform header, and upload files using multipart syntax (files=@/path). Uploading user-provided images is expected, but the guidance to reference filesystem paths and to probe install/config paths could lead the agent to read or transmit files beyond the user-intended images if not tightly controlled.

Install Mechanism

Instruction-only skill with no install spec and no code files. Nothing is written to disk by an installer; lower install risk.

Credentials

Only one credential (NEMO_TOKEN) is declared which is appropriate. The SKILL.md also instructs obtaining and storing an anonymous token automatically if none exists — that behavior can persist a secret in the environment or config and should be explicit to the user. The YAML metadata's configPaths entry is not declared in registry metadata, creating ambiguity about where secrets/sessions might be stored.

Persistence & Privilege

always:false and no cross-skill or system-wide config modifications are requested. The skill does instruct persisting session_id and possibly NEMO_TOKEN locally (environment or config directory); this is normal for session-based APIs but means long-lived tokens could reside on disk unless the agent/platform controls persistence.

What to consider before installing

This skill appears to do what it says (upload images and call a remote render API) but exercise caution before installing or using it broadly. Key things to consider: 1) Source and trust: there is no homepage or known source — that raises risk if you’ll be sending files or creating tokens. 2) Token handling: the skill will try to auto-create and persist an anonymous NEMO_TOKEN if none is present; prefer creating and scoping your own token (and limiting its lifetime/permissions) rather than letting the skill persist secrets for you. 3) File access: only send images you intend to share (test first with non-sensitive images); the instructions reference filesystem paths and probing install/config directories, so confirm the agent will only upload explicitly provided files. 4) Persistence: session IDs and tokens may be stored in a config directory — check where and remove them when done. 5) Inconsistencies: metadata mentions a config path that the registry doesn't declare; ask the publisher to clarify storage locations and exact persistence behavior before trusting sensitive content. If you proceed, test with throwaway images and rotate or delete tokens after use.

Getting Started

Share your images and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

• "convert my images"
• "export 1080p MP4"
• "turn my images into a smooth"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Image to Video AI — Convert Images Into Video Clips

Send me your images and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload three product photos in JPG format, type "turn my images into a smooth video with transitions and background music", and you'll get a 1080p MP4 back in roughly 30-60 seconds. All rendering happens server-side.

Worth noting: using fewer images with higher resolution gives smoother results.

Matching Input to Actions

User prompts referencing image to video oi, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is image-to-video-oi, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "turn my images into a smooth video with transitions and background music" — concrete instructions get better results.

Max file size is 200MB. Stick to JPG, PNG, WEBP, HEIC for the smoothest experience.

Export as MP4 for widest compatibility.

Common Workflows

Quick edit: Upload → "turn my images into a smooth video with transitions and background music" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.