Video App

Get polished MP4 files ready to post, without touching a single slider. Upload your video clips (MP4, MOV, AVI, WebM, up to 500MB), say something like "trim...

Security Scan

The skill's behavior is mostly consistent with a cloud video-editing service, but there are metadata inconsistencies and instructions that probe environment/install paths and create short-lived tokens — things you should verify before installing or giving it access.

Purpose & Capability

The name/description (cloud video editing) matches the actions (upload, render, export via mega-api-prod.nemovideo.ai) and the only declared credential is NEMO_TOKEN, which is expected. However the SKILL.md frontmatter includes a configPaths entry (~/.config/nemovideo/) that is not reflected in the registry summary's 'Required config paths: none' — an inconsistency that may indicate the skill expects access to a user config directory.

Instruction Scope

The runtime instructions tell the agent to check the environment for NEMO_TOKEN and, if missing, generate an anonymous token by POSTing to the service (including generating a UUID client id). They also instruct adding attribution headers and deriving X-Skill-Platform from the agent's install path (~/.clawhub/, ~/.cursor/skills/, otherwise 'unknown'). Detecting the install path or reading a config directory implies filesystem probing beyond simply uploading video files. The skill also mediates SSE streams and polls state. None of that is intrinsically malicious, but the instructions give the agent permission to read environment/install-path context and to call external endpoints — verify you trust the service and that reading those paths is acceptable.

Install Mechanism

There is no install spec and no code files — instruction-only skill — so nothing is written to disk by the skill itself. This is the lowest-risk install mechanism.

Credentials

Only NEMO_TOKEN is declared as a required env var (primary credential), which is proportional for a cloud API. But the SKILL.md frontmatter's metadata lists a configPaths entry that implies the skill might access ~/.config/nemovideo/ (not shown in the registry summary). That mismatch should be clarified: does the skill actually need to read that path?

Persistence & Privilege

always is false and the skill is user-invocable; it does not request permanent 'always' presence. It creates ephemeral session tokens and may orphan jobs if a session is closed, but it does not request elevated platform privileges in the manifest.

What to consider before installing

This skill appears to be a front-end for a cloud video-editing service (mega-api-prod.nemovideo.ai) and only requires a NEMO_TOKEN to operate — that's expected. Before installing or using it: 1) Confirm you trust the nemovideo.ai domain and the skill owner, because uploaded video files will be sent to that backend and may contain sensitive content. 2) Ask the publisher to explain the metadata mismatch: SKILL.md mentions a config path (~/.config/nemovideo/) but the registry summary says none — clarify whether the skill will read that directory. 3) Decide whether you are comfortable with the skill probing install paths (it will derive X-Skill-Platform from locations like ~/.clawhub/ or ~/.cursor/skills/), which reveals presence of other tooling. 4) Prefer using an explicit, limited token (or anonymous token) and avoid exposing long-lived credentials; review what the skill logs or returns to users. 5) If you need higher assurance, request source or homepage, or run network/FS monitoring during an initial test to confirm behavior matches these instructions.

Getting Started

Got video clips to work with? Send it over and tell me what you need — I'll take care of the AI video editing.

Try saying:

• "edit a 2-minute smartphone recording into a 1080p MP4"
• "trim the silent parts, add background music, and export in 1080p"
• "quickly editing and exporting videos without complex software for content creators"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

• Generate a UUID as client identifier
• POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
• Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Video App — Edit and Export Videos Fast

Drop your video clips in the chat and tell me what you need. I'll handle the AI video editing on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 2-minute smartphone recording, ask for trim the silent parts, add background music, and export in 1080p, and about 1-2 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips under 60 seconds process significantly faster.

Matching Input to Actions

User prompts referencing video app, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is video-app, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend says	You do
"click [button]" / "点击"	Execute via API
"open [panel]" / "打开"	Query session state
"drag/drop" / "拖拽"	Send edit via SSE
"preview in timeline"	Show track summary
"Export button" / "导出"	Execute export workflow

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "trim the silent parts, add background music, and export in 1080p" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "trim the silent parts, add background music, and export in 1080p" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.