Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Compressor High Quality

v1.0.0

Get compressed MP4 files ready to post, without touching a single slider. Upload your large video files (MP4, MOV, AVI, WebM, up to 500MB), say something lik...

0· 35·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for whitejohnk-26/video-compressor-high-quality.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Video Compressor High Quality" (whitejohnk-26/video-compressor-high-quality) from ClawHub.
Skill page: https://clawhub.ai/whitejohnk-26/video-compressor-high-quality
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: NEMO_TOKEN
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install video-compressor-high-quality

ClawHub CLI

Package manager switcher

npx clawhub@latest install video-compressor-high-quality
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (cloud video compression) matches the required credential (NEMO_TOKEN) and the API endpoints it documents. However, the SKILL.md frontmatter lists a config path (~/.config/nemovideo/) while the registry metadata shown earlier lists no required config paths — this mismatch is unexplained and could indicate packaging/metadata errors or an implicit need to read user config files.
!
Instruction Scope
Instructions tell the agent to automatically connect on first use, create an anonymous token if NEMO_TOKEN is not set, POST it to the remote API, and 'store the returned session_id' for later requests. There is no clear user-consent step before the backend connection or uploading of files, and the doc explicitly instructs the agent to avoid displaying raw API responses or token values to the user. These behaviors broaden the agent's runtime actions beyond passive guidance and raise privacy/visibility concerns (automatic outbound network calls and potential uploads).
Install Mechanism
This is an instruction-only skill with no install spec or code files, so there is no local install artifact risk. Network calls are to a named domain (mega-api-prod.nemovideo.ai) rather than an arbitrary IP/paste site.
Credentials
Requiring a single API credential (NEMO_TOKEN) is reasonable for a remote compression service. However, the combination of (a) automatic anonymous-token creation when NEMO_TOKEN is absent and (b) frontmatter referencing a user config path suggests the skill may read or write local config files or persist tokens — this is not justified in the description and could grant broader local access than users expect.
Persistence & Privilege
The skill does not request always:true and does not declare elevated privileges. It does instruct storing session_id and (implicitly) persisting a token if generated, which is normal for session-based APIs but should be explicit about storage location and lifetime. Autonomous invocation is allowed by default (normal), which combined with automatic token generation increases the chance of background network activity unless the agent/platform prompts the user.
What to consider before installing
Before installing or using this skill: 1) Understand that files you upload will be sent to mega-api-prod.nemovideo.ai for cloud processing — do not upload sensitive or private videos unless you trust that service. 2) Prefer providing your own NEMO_TOKEN rather than letting the skill generate an anonymous token (so you control lifecycle and visibility). 3) Ask the maintainer or inspect logs to confirm where generated tokens and session_ids are stored (env var, config file under ~/.config/nemovideo/, or ephemeral memory). 4) Be aware the skill will auto-connect on first use and may upload files without an explicit per-upload confirmation; if you want explicit consent, request that behavior change. 5) The frontmatter/config-path mismatch is unexplained — if this matters to you, ask the publisher for clarification or for a version with clearer, minimal metadata. If you want, provide me with the exact lines around the frontmatter or ask the publisher for the service's privacy/security documentation and I can re-evaluate.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🗜️ Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97527n4v2q9x40vvtaa28h96185j0f2
35downloads
0stars
1versions
Updated 1d ago
v1.0.0
MIT-0

Getting Started

Send me your large video files and I'll handle the AI video compression. Or just describe what you're after.

Try saying:

  • "compress a 1.2GB 4K travel video recorded on a DSLR into a 1080p MP4"
  • "compress this video to under 100MB without losing noticeable quality"
  • "reducing video file size while preserving visual quality for content creators, marketers, students"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

  1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
  2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Video Compressor High Quality — Compress Videos Without Losing Quality

Drop your large video files in the chat and tell me what you need. I'll handle the AI video compression on cloud GPUs — you don't need anything installed locally.

Here's a typical use: you send a a 1.2GB 4K travel video recorded on a DSLR, ask for compress this video to under 100MB without losing noticeable quality, and about 1-3 minutes later you've got a MP4 file ready to download. The whole thing runs at 1080p by default.

One thing worth knowing — shorter clips compress faster and give you more control over quality settings.

Matching Input to Actions

User prompts referencing video compressor high quality, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcevideo-compressor-high-quality
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

EventAction
Text responseApply GUI translation (§4), present to user
Tool call/resultProcess internally, don't forward
heartbeat / empty data:Keep waiting. Every 2 min: "⏳ Still working..."
Stream closesProcess final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

  • "click" or "点击" → execute the action via the relevant endpoint
  • "open" or "打开" → query session state to get the data
  • "drag/drop" or "拖拽" → send the edit command through SSE
  • "preview in timeline" → show a text summary of current tracks
  • "Export" or "导出" → run the export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

  • 0 — success, continue normally
  • 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
  • 1002 — session not found; create a new one
  • 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
  • 4001 — unsupported file type; show accepted formats
  • 4002 — file too large; suggest compressing or trimming
  • 400 — missing X-Client-Id; generate one and retry
  • 402 — free plan export blocked; not a credit issue, subscription tier
  • 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "compress this video to under 100MB without losing noticeable quality" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

H.264 codec gives the best balance of quality and size.

Common Workflows

Quick edit: Upload → "compress this video to under 100MB without losing noticeable quality" → Download MP4. Takes 1-3 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Comments

Loading comments...