ClawHub

Freebeat

v1.0.0

Tired of manually hunting for the perfect playlist that actually matches your workout intensity? Freebeat transforms how you experience fitness by syncing im...

⭐ 0· 33·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (beat‑matched workout sessions, classes, exports, uploads) match the runtime API actions in SKILL.md: session creation, SSE messaging, uploads, credits, and exports against mega-api-prod.nemovideo.ai. The single declared env var (NEMO_TOKEN) is the expected credential for that API.
ℹ
Instruction Scope
Instructions remain within the skill's domain but do ask the agent to read/create a local UUID file at ~/.config/freebeat/client_id, save session_id, and accept/upload user-provided files/URLs to the remote API. Those filesystem reads/writes and user-file uploads are expected for this use case but are the main side effects to be aware of.
✓
Install Mechanism
No install spec or code is provided (instruction-only). No downloads or package installs are requested, so nothing is written to disk beyond the client_id file the skill explicitly creates/reads at runtime.
✓
Credentials
The only required environment variable is NEMO_TOKEN (declared as primaryEnv) which is proportionate to the API calls described. I see no other hidden env or credential requirements in the instructions.
✓
Persistence & Privilege
always is false and autonomous invocation is not disabled (platform default). The skill only persists a local client_id and session_id; it does not request system-wide modifications or other skills' credentials.
Assessment
This skill is internally consistent, but before installing consider: (1) NEMO_TOKEN grants API access — if you supply a personal account token it can be used for all actions the API permits; (2) if you don't set NEMO_TOKEN the skill will create/read ~/.config/freebeat/client_id and request an anonymous token from https://mega-api-prod.nemovideo.ai, which issues short-lived credits; (3) the skill allows uploading files or URLs you provide to the remote API — don't upload sensitive files you don't want sent to an external service; (4) review the API hostname (mega-api-prod.nemovideo.ai) to confirm it matches the service you expect; (5) because this is instruction-only, no additional software is installed, but the skill will store a client_id and session_id in your user config. If any of these behaviors are unacceptable, do not enable the skill or provide your account token.

Like a lobster shell, security has layers — review code before you run it.

latestvk9709m6yy37a90xyj2hq44t2nd840whf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments