Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Trimmer Mp3

v1.0.0

Turn a 10-minute MP4 video with audio into 1080p trimmed MP3 audio just by typing what you need. Whether it's cutting video down to key moments and extractin...

0· 88·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for vcarolxhberger/video-trimmer-mp3.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Trimmer Mp3" (vcarolxhberger/video-trimmer-mp3) from ClawHub.
Skill page: https://clawhub.ai/vcarolxhberger/video-trimmer-mp3
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-trimmer-mp3

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-trimmer-mp3
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (trim video and extract MP3) align with the API endpoints and workflows in SKILL.md. Requiring a single service token (NEMO_TOKEN) is reasonable for a cloud processing service. However, the SKILL.md frontmatter also lists a config path (~/.config/nemovideo/) while the registry metadata said no required config paths — this mismatch is unexplained.
!
Instruction Scope
Most instructions stay within the service (auth, create session, upload, render, poll). But the skill instructs the agent to derive headers from install-path detection (checking ~/.clawhub, ~/.cursor/skills/, etc.) and references a config path in its YAML frontmatter. That implies the agent may inspect local filesystem locations to set headers, which is outside the core trimming/upload task and isn't justified by the description. The upload endpoint uses multipart file upload (files=@/path) which legitimately requires access to user-provided files, but the additional filesystem/config probing is unnecessary and worth questioning.
Install Mechanism
No install spec and no code files — instruction-only skill. This is lower risk because nothing is written to disk by an installer.
Credentials
Only one credential is declared (NEMO_TOKEN), which is appropriate for a cloud API. The SKILL.md supports generating an anonymous token if none is present. The unexplained presence of configPaths in the skill's frontmatter (but not in the registry metadata) raises a proportionality question: why would the skill need access to a local ~/.config/nemovideo/ directory?
Persistence & Privilege
always is false and there is no install step that requests permanent system presence or modifies other skills. The skill asks to 'save session_id' (expected for an active session) but does not ask to store broader system credentials or change global settings.
What to consider before installing
This skill appears to do what it says: it uploads video to a remote service and returns trimmed video/MP3 output using a NEMO_TOKEN. Before installing/using it, confirm two things: (1) the skill may read certain local paths to determine an install platform or config (~/.clawhub, ~/.cursor/skills/, and its frontmatter mentions ~/.config/nemovideo/) — ask the publisher why that is needed and refuse/deny filesystem access if you’re uncomfortable; (2) your videos are uploaded to https://mega-api-prod.nemovideo.ai — do not send sensitive content if you don't trust that remote service. If you don't already have a NEMO_TOKEN, the skill will generate an anonymous token by contacting the service; that is normal but still means files go to that provider. If the author cannot justify the config-path checks or the platform-detection headers, treat this as a red flag and avoid use.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

✂️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97dfthp9mrv62njmbcgv8s4wx8599jx
88downloads
0stars
1versions
Updated 6d ago
v1.0.0
MIT-0

Getting Started

Send me your video files and I'll handle the AI video trimming. Or just describe what you're after.

Try saying:

  • "trim a 10-minute MP4 video with audio into a 1080p MP4"
  • "trim the video to the best 3 minutes and export the audio as MP3"
  • "cutting video down to key moments and extracting MP3 audio for podcasters, content creators, students"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Video Trimmer MP3 — Trim Video and Extract MP3

Drop your video files in the chat and tell me what you need. I'll handle the AI video trimming on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 10-minute MP4 video with audio, ask for trim the video to the best 3 minutes and export the audio as MP3, and about 30-60 seconds later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter source clips process faster and produce cleaner audio extraction.

Matching Input to Actions

User prompts referencing video trimmer mp3, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-trimmer-mp3, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the video to the best 3 minutes and export the audio as MP3" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility, then extract MP3 for audio-only sharing.

Common Workflows

Quick edit: Upload → "trim the video to the best 3 minutes and export the audio as MP3" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...