Shop Video

Turn a 60-second product demo recording into 1080p shoppable product videos just by typing what you need. Whether it's turning product footage into shoppable...

Security Scan

The skill's runtime instructions generally match its stated purpose (upload video → cloud render), but there are inconsistencies and privacy risks you should understand before installing.

Purpose & Capability

The skill claims to convert product footage into shoppable videos and only requires a single service token (NEMO_TOKEN), which is coherent for a cloud rendering API. However, the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) while the registry metadata lists no required config paths — this inconsistency should be resolved because access to a local config directory would be out-of-scope for a simple upload/processing tool unless that directory holds credentials or client config.

Instruction Scope

Instructions are concrete and focused on interacting with a cloud API (anonymous-token creation, session start, file upload, SSE streaming, render/poll). That is within scope. The agent is explicitly instructed to upload user video files to https://mega-api-prod.nemovideo.ai and to persist session_id and use tokens; uploading user media to an external service is expected for this product but has privacy implications. The SKILL.md also requires including attribution headers and 'auto-detect' the platform from the install path, which implies the agent may inspect its environment/install path — this is reasonable but worth noting.

Install Mechanism

No install spec and no code files are present (instruction-only). This is the lowest-risk install pattern: nothing is written to disk by an installer from the registry.

Credentials

Only one credential (NEMO_TOKEN) is declared as required and is appropriate for a cloud API. However, SKILL.md frontmatter mentions a config path (~/.config/nemovideo/) that would grant local config access if used; the registry metadata did not list that path — this mismatch is disproportionate and raises the question whether the agent will read local config files containing other secrets.

Persistence & Privilege

always:false and no special persistence is requested. The skill does not request to modify other skills or system-wide settings. The skill is allowed to be invoked autonomously by the model (default), which is normal; nothing in the skill amplifies this into a higher privilege.

What to consider before installing

This skill appears to do what it says — it uploads your videos to a third-party render API and returns a processed MP4 — but pay attention to privacy and metadata mismatches before installing: - Confirm the service domain (mega-api-prod.nemovideo.ai) and the provider's reputation. There is no homepage or source listed in the registry metadata. - Understand that your video files (possibly containing sensitive product or customer information) will be uploaded to that external service. If in doubt, test with non-sensitive footage first. - The skill asks for a NEMO_TOKEN. If you don't already have one, the skill will create an anonymous token with 7‑day validity — consider using that rather than a long-lived production credential. - Ask the publisher why SKILL.md lists a local config path (~/.config/nemovideo/) while the registry metadata shows none. Accessing local config could expose other credentials; do not grant or place secrets there unless you trust the source. - If you will use the skill in sensitive environments, prefer creating minimal-scope/throwaway tokens, and do not allow the agent to access other credentials. If unsure, treat this skill as untrusted until you can confirm the vendor and the intended behavior.

Getting Started

Send me your product video footage and I'll handle the AI shopping video creation. Or just describe what you're after.

Try saying:

• "create a 60-second product demo recording into a 1080p MP4"
• "add price tags, product highlights, and a buy-now call-to-action"
• "turning product footage into shoppable videos with overlays and CTAs for e-commerce marketers"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Shop Video — Create Shoppable Product Videos

This tool takes your product video footage and runs AI shopping video creation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a 60-second product demo recording and want to add price tags, product highlights, and a buy-now call-to-action — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: keep product clips under 90 seconds for faster processing and better viewer retention.

Matching Input to Actions

User prompts referencing shop video, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Base URL: https://mega-api-prod.nemovideo.ai

Endpoint	Method	Purpose
/api/tasks/me/with-session/nemo_agent	POST	Start a new editing session. Body: {"task_name":"project","language":"<lang>"}. Returns session_id.
/run_sse	POST	Send a user message. Body includes app_name, session_id, new_message. Stream response with Accept: text/event-stream. Timeout: 15 min.
/api/upload-video/nemo_agent/me/<sid>	POST	Upload a file (multipart) or URL.
/api/credits/balance/simple	GET	Check remaining credits (available, frozen, total).
/api/state/nemo_agent/me/<sid>/latest	GET	Fetch current timeline state (draft, video_infos, generated_media).
/api/render/proxy/lambda	POST	Start export. Body: {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll status every 30s.

Accepted file types: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Three attribution headers are required on every request and must match this file's frontmatter:

Header	Value
X-Skill-Source	shop-video
X-Skill-Version	frontmatter version
X-Skill-Platform	auto-detect: clawhub / cursor / unknown from install path

Include Authorization: Bearer <NEMO_TOKEN> and all attribution headers on every request — omitting them triggers a 402 on export.

Error Handling

Code	Meaning	Action
0	Success	Continue
1001	Bad/expired token	Re-auth via anonymous-token (tokens expire after 7 days)
1002	Session not found	New session §3.0
2001	No credits	Anonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001	Unsupported file	Show supported formats
4002	File too large	Suggest compress/trim
400	Missing X-Client-Id	Generate Client-Id and retry (see §1)
402	Free plan export blocked	Subscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429	Rate limit (1 token/client/7 days)	Retry in 30s once

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Common Workflows

Quick edit: Upload → "add price tags, product highlights, and a buy-now call-to-action" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add price tags, product highlights, and a buy-now call-to-action" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility across e-commerce platforms and social media.