Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Subtitle Generator Best

v1.0.0

Turn a 10-minute YouTube tutorial video into 1080p captioned video files just by typing what you need. Whether it's adding accurate subtitles to YouTube and...

0· 57·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill's stated purpose (AI subtitle generation and cloud rendering) aligns with its runtime instructions to upload media and call nemovideo.ai endpoints and thus legitimately needs an API token. However there is an internal mismatch: the registry metadata lists no required config paths, while the SKILL.md frontmatter declares a configPaths entry (~/.config/nemovideo/). That inconsistency is unexplained and reduces confidence in the packaging/authoring.
Instruction Scope
SKILL.md gives concrete API flows (anonymous-token acquisition, session creation, SSE, upload, render, polling) which are appropriate for a cloud subtitle/render service. It also instructs deriving an X-Skill-Platform value from an install path (~/.clawhub/, ~/.cursor/skills/) which implies the agent might inspect install locations — a minor scope creep that should be explicit (why is that needed?). Otherwise instructions do not request unrelated system files or other credentials.
Install Mechanism
This is an instruction-only skill with no install spec and no code files, so nothing will be downloaded or written by an installer. That minimizes disk-write risk.
Credentials
The skill requires a single credential (NEMO_TOKEN), which is proportionate to a cloud API-based subtitle/render service. Still: SKILL.md describes creating/using an anonymous token if none is provided, and the frontmatter's configPaths declaration (not present in registry) is inconsistent. The single required env var appears justified, but verify you trust the endpoint before supplying a long-lived token.
Persistence & Privilege
always is false and there is no install-time persistence or modifications to other skills. The skill requires network access to an external API and can be invoked autonomously (default), which is expected for a cloud processing skill; not flagged on its own.
What to consider before installing
Consider these steps before installing or using the skill: 1) Confirm the external service and domain (mega-api-prod.nemovideo.ai) are legitimate and acceptable for your content — the skill has no homepage or published provenance. 2) Prefer using an anonymous/ephemeral token or a throwaway account when testing; avoid giving a long-lived or highly-privileged NEMO_TOKEN until you trust the service. 3) Don't upload sensitive videos (containing secrets, PII, proprietary content) until you verify retention and privacy policies with the service owner. 4) Ask the author to clarify the metadata mismatch (registry vs SKILL.md configPaths) and why the skill needs to infer install paths — this should be explicit. 5) If you need higher assurance, request the skill's source or a vendor/privacy link; otherwise test with non-sensitive sample videos first.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk976r7fwr5bwyf09my47cxf8nd84nr1m
57downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Getting Started

Share your video files and I'll get started on AI subtitle generation. Or just tell me what you're thinking.

Try saying:

  • "generate my video files"
  • "export 1080p MP4"
  • "generate accurate subtitles in English and"

Getting Connected

Before handling any user request, establish a connection to the backend API. Show a brief status like "Connecting...".

If NEMO_TOKEN is in the environment, use it directly and create a session. Otherwise, acquire a free starter token:

  • Generate a UUID as client identifier
  • POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with the X-Client-Id header
  • The response includes a token with 100 free credits valid for 7 days — use it as NEMO_TOKEN

Then create a session by POSTing to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer authorization and body {"task_name":"project","language":"en"}. The session_id in the response is needed for all following requests.

Tell the user you're ready. Keep the technical details out of the chat.

AI Subtitle Generator Best — Generate and Embed Video Subtitles

Drop your video files in the chat and tell me what you need. I'll handle the AI subtitle generation on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 10-minute YouTube tutorial video, ask for generate accurate subtitles in English and Spanish automatically, and about 30-60 seconds later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 5 minutes produce the most accurate subtitle sync.

Matching Input to Actions

User prompts referencing ai subtitle generator best, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is ai-subtitle-generator-best, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate accurate subtitles in English and Spanish automatically" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across all platforms.

Common Workflows

Quick edit: Upload → "generate accurate subtitles in English and Spanish automatically" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...