Ai Powered Video Editor

Cloud-based ai-powered-video-editor tool that handles automatically editing raw footage into shareable videos. Upload MP4, MOV, AVI, WebM files (up to 500MB)...

Security Scan

The skill's instructions match a cloud video-editing purpose, but metadata inconsistencies, missing publisher/homepage, and ambiguous config/path handling mean you should be cautious before installing or giving it credentials.

Purpose & Capability

Name and runtime instructions describe a cloud video editing service and the single required credential (NEMO_TOKEN) is appropriate for that purpose. However, the SKILL.md frontmatter advertises a config path (~/.config/nemovideo/) and X-Skill-Platform detection that are not reflected in the registry summary — an inconsistency that could imply filesystem access or undisclosed config usage.

Instruction Scope

Instructions are within the expected scope (create session, upload user video files, SSE streaming, start render, poll state). Concerns: (1) it instructs deriving X-Skill-Platform from install paths (checking ~/.clawhub/ or ~/.cursor/skills/) which implies probing the host filesystem; (2) it requires uploading potentially sensitive user videos to an externally hosted API with no homepage or source provenance provided; and (3) it tells the agent to 'save session_id' but gives no guidance whether that is in-memory only or persisted to disk (especially given the config path in metadata).

Install Mechanism

No install spec and no code files (instruction-only). This is lower-risk because nothing is automatically downloaded or written by an installer. The runtime behavior will be limited to the agent following the prose in SKILL.md.

Credentials

Only NEMO_TOKEN is declared as required and is a reasonable credential for a cloud API. The skill also documents an anonymous-token flow (no secret required). That said, the frontmatter's configPaths entry (~/ .config/nemovideo/) is inconsistent with the registry summary and is unexplained — it could indicate additional config/credential files may be read or written.

Persistence & Privilege

Skill is not force-included (always:false) and allows normal autonomous invocation (expected). The runtime asks to 'save session_id' and metadata references a config path, but there is no clear instruction whether anything will be persisted to disk or shared across sessions — this ambiguity increases risk modestly.

Scan Findings in Context

[no_scan_findings] expected: No code files were present so the regex-based scanner had nothing to analyze. The assessment therefore relies on SKILL.md content.

What to consider before installing

This skill appears to do what its description says (cloud-based video editing) and only asks for one credential (NEMO_TOKEN), but there are a few reasons to be cautious: 1) The skill has no published homepage or source — you can't verify the provider or their privacy/security practices. 2) The SKILL.md metadata mentions a config path (~/.config/nemovideo/) and asks the agent to detect install paths for X-Skill-Platform; this is inconsistent with the registry summary and could mean the skill may read or write files. 3) Using the skill will upload your raw videos to an external API — review the service's data retention and privacy policies before uploading sensitive content. Before installing or enabling the skill, consider: - Ask the publisher for a homepage, privacy policy, and source code or an explanation of the configPath usage. - Prefer the anonymous-token flow (short-lived token) over placing a long-lived NEMO_TOKEN in your environment. - Avoid uploading sensitive videos until you confirm the provider's trustworthiness. - If you must try it, use disposable accounts/tokens and monitor for unexpected filesystem access. If the author can confirm they do not read or persist user files or host local configs, and can provide provenance (homepage or repo), my confidence would rise.

Getting Started

Share your raw video footage and I'll get started on AI-powered video editing. Or just tell me what you're thinking.

Try saying:

• "edit my raw video footage"
• "export 1080p MP4"
• "cut the pauses, add background music,"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

AI Powered Video Editor — Edit and Export Polished Videos

Send me your raw video footage and describe the result you want. The AI-powered video editing runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 3-minute unedited screen recording, type "cut the pauses, add background music, and export as a clean 60-second clip", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter clips under 2 minutes process significantly faster and yield cleaner AI cuts.

Matching Input to Actions

User prompts referencing ai powered video editor, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is ai-powered-video-editor, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "cut the pauses, add background music, and export as a clean 60-second clip" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "cut the pauses, add background music, and export as a clean 60-second clip" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 with H.264 codec for the widest platform compatibility.