Pixabay Music Ab2n 0330
v1.0.0Tell me what you need and I'll find the perfect royalty-free track from Pixabay's vast music library to match your video's mood, pace, or theme. This pixabay...
⭐ 0· 80·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill advertises 'Pixabay' music but all API calls are routed through NemoVideo's backend (mega-api-prod.nemovideo.ai) and require a NEMO_TOKEN. This is coherent if NemoVideo is acting as a proxy/index for Pixabay, but users should note that requests and uploaded videos go to NemoVideo rather than directly to pixabay.com.
Instruction Scope
Runtime instructions are limited to: use NEMO_TOKEN, create/read ~/.config/nemovideo/client_id, request an anonymous token, create a session, call NemoVideo endpoints (search, SSE, upload, export). These actions are consistent with the stated purpose. Two small concerns: (1) the instructions say the anonymous response token 'becomes your NEMO_TOKEN' (ambiguous about whether it is persisted), and (2) the session claim URL includes the token in a query parameter, which can leak the token if the URL is logged/shared. The SKILL.md also tells the agent not to print tokens or raw JSON.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is written to disk by an installer. The only file interaction described is reading/creating ~/.config/nemovideo/client_id, which is declared in metadata.
Credentials
Only one credential (NEMO_TOKEN) is required and is declared as the primaryEnv. The skill also declares the config path it uses (~/.config/nemovideo/). There are no unrelated credentials or broad secret requests.
Persistence & Privilege
The skill is not marked always:true and does not request permanent system-wide privileges. It asks to read/create a per-user client_id file and to store session identifiers for the task, which is reasonable for this functionality.
Assessment
This skill proxies Pixabay searches through the NemoVideo service and requires a NEMO_TOKEN (or will fetch a short-lived anonymous token using a per-user client_id file at ~/.config/nemovideo/client_id). Before installing: (1) confirm you trust nemovideo.com because your search queries, session IDs, and any uploaded video files will route through their backend; (2) be aware the skill constructs a 'claim' URL that includes the token as a query parameter — treat that URL as sensitive because it can leak the token if logged or shared; (3) the anonymous token the skill can create is time-limited (described as 7 days) but may grant access to your NemoVideo session—revoke or rotate it if you stop using the skill; (4) if you need direct, auditable access to Pixabay-only resources, prefer a skill that calls pixabay.com directly or verify NemoVideo's licensing/terms. If you want, I can highlight the exact lines in SKILL.md that create or expose tokens and sessions.Like a lobster shell, security has layers — review code before you run it.
latestvk97bahw256zz9mwyvhs130s1sx83w4xa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN