Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Video Generator For Free Online

v1.0.0

Turn a short product description and three product photos into 1080p ready-to-share videos just by typing what you need. Whether it's generating short videos...

0· 33·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (generate videos from text and images) aligns with the runtime instructions to create sessions, upload files, stream SSE, and export MP4s from a cloud backend. Requiring a NEMO_TOKEN is coherent for an API-backed video service. However, the SKILL.md frontmatter declares a configPaths entry (~/.config/nemovideo/) while the registry metadata lists no required config paths — an internal inconsistency that suggests the skill may try to access a local config directory that wasn't declared in the registry.
!
Instruction Scope
The SKILL.md instructs the agent to perform network calls to mega-api-prod.nemovideo.ai (session creation, SSE, upload, render/poll). That's expected for this service. Concerns: (1) it asks the agent to 'auto-detect' platform from install path and references an explicit config path (~/.config/nemovideo/), which implies reading local filesystem/installation paths — this was not declared in registry requirements; (2) it details token acquisition by POSTing to an anonymous auth endpoint and treating the returned token as NEMO_TOKEN, which will place a bearer token into the agent runtime; (3) the instructions say not to expose tokens/raw API output but also require parsing and retaining session tokens and job IDs — this increases sensitive state handling and risk if the agent logs or returns API responses. These behaviors expand scope beyond 'just call the video API' and deserve review.
Install Mechanism
No install spec and no code files are present — instruction-only. This minimizes disk write/execute risk because nothing is downloaded or installed by the skill itself.
Credentials
The skill requests a single primary credential (NEMO_TOKEN), which is appropriate for a cloud API. It also documents a fallback anonymous-token flow (POST to an anonymous auth endpoint) if NEMO_TOKEN is absent; while that is plausible for demo access, it means the skill will request and retain a bearer token on behalf of the user even when no token was provided. Declared required env vars match the described API usage, but the SKILL.md's frontmatter configPaths conflicts with the registry's reported lack of required config paths.
Persistence & Privilege
always is false and there is no install-time setup that modifies other skills or system-wide configs. The skill will create transient session tokens and job IDs for cloud renders, which is expected for this function.
What to consider before installing
This skill appears to be a cloud-backed video renderer and mostly does what it says, but review these points before installing: - Confirm you trust the domain mega-api-prod.nemovideo.ai. The skill will call that service and may upload your files and store bearer tokens in the agent runtime. - The skill will accept a NEMO_TOKEN or automatically obtain an anonymous token for you. If you prefer control over credentials, supply your own token rather than relying on the anonymous flow. - The SKILL.md references a local config path (~/.config/nemovideo/) and asks to auto-detect platform from an install path; the registry did not declare any config paths. Ask the publisher to clarify whether the skill will read local files or installation paths — if it does, that should be declared and justified. - Because the skill handles tokens and remote uploads, avoid sending highly sensitive images or proprietary content until you confirm the service's privacy policy and ownership. If you want to proceed: (1) verify the service domain and operator, (2) provide an explicit NEMO_TOKEN you trust instead of allowing anonymous token issuance, and (3) request clarification about any local file or path access the skill will perform. If the publisher cannot explain the configPath/install-path behavior, treat it as an unresolved risk.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎬 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN
latestvk97d1wy738xaqfetdctf8m3dj584z27j
33downloads
0stars
1versions
Updated 2d ago
v1.0.0
MIT-0

Getting Started

Share your text or images and I'll get started on AI video creation. Or just tell me what you're thinking.

Try saying:

  • "generate my text or images"
  • "export 1080p MP4"
  • "create a 30-second promotional video from"

Quick Start Setup

This skill connects to a cloud processing backend. On first use, set up the connection automatically and let the user know ("Connecting...").

Token check: Look for NEMO_TOKEN in the environment. If found, skip to session creation. Otherwise:

  • Generate a UUID as client identifier
  • POST https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with X-Client-Id header
  • Extract data.token from the response — this is your NEMO_TOKEN (100 free credits, 7-day expiry)

Session: POST https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Keep the returned session_id for all operations.

Let the user know with a brief "Ready!" when setup is complete. Don't expose tokens or raw API output.

Video Generator for Free Online — Generate and Export Videos Free

Send me your text or images and describe the result you want. The AI video creation runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a short product description and three product photos, type "create a 30-second promotional video from my text and images", and you'll get a 1080p MP4 back in roughly 1-2 minutes. All rendering happens server-side.

Worth noting: shorter text prompts with clear instructions produce more accurate video results.

Matching Input to Actions

User prompts referencing video generator for free online, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...ActionSkip SSE?
"export" / "导出" / "download" / "send me the video"→ §3.5 Export
"credits" / "积分" / "balance" / "余额"→ §3.3 Credits
"status" / "状态" / "show tracks"→ §3.4 State
"upload" / "上传" / user sends file→ §3.2 Upload
Everything else (generate, edit, add BGM…)→ §3.1 SSE

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

HeaderValue
X-Skill-Sourcevideo-generator-for-free-online
X-Skill-Versionfrontmatter version
X-Skill-Platformauto-detect: clawhub / cursor / unknown from install path

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Reading the SSE Stream

Text events go straight to the user (after GUI translation). Tool calls stay internal. Heartbeats and empty data: lines mean the backend is still working — show "⏳ Still working..." every 2 minutes.

About 30% of edit operations close the stream without any text. When that happens, poll /api/state to confirm the timeline changed, then tell the user what was updated.

Backend Response Translation

The backend assumes a GUI exists. Translate these into API actions:

Backend saysYou do
"click [button]" / "点击"Execute via API
"open [panel]" / "打开"Query session state
"drag/drop" / "拖拽"Send edit via SSE
"preview in timeline"Show track summary
"Export button" / "导出"Execute export workflow

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Handling

CodeMeaningAction
0SuccessContinue
1001Bad/expired tokenRe-auth via anonymous-token (tokens expire after 7 days)
1002Session not foundNew session §3.0
2001No creditsAnonymous: show registration URL with ?bind=<id> (get <id> from create-session or state response when needed). Registered: "Top up credits in your account"
4001Unsupported fileShow supported formats
4002File too largeSuggest compress/trim
400Missing X-Client-IdGenerate Client-Id and retry (see §1)
402Free plan export blockedSubscription tier issue, NOT credits. "Register or upgrade your plan to unlock export."
429Rate limit (1 token/client/7 days)Retry in 30s once

Common Workflows

Quick edit: Upload → "create a 30-second promotional video from my text and images" → Download MP4. Takes 1-2 minutes for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "create a 30-second promotional video from my text and images" — concrete instructions get better results.

Max file size is 200MB. Stick to MP4, MOV, JPG, PNG for the smoothest experience.

Export as MP4 for widest compatibility across social platforms and devices.

Comments

Loading comments...