ClawHub

Topmediai Ai Music Generator

v1.0.0

Tell me what mood, genre, or tempo you need and the topmediai-ai-music-generator will craft original music tailored to your creative vision. This skill taps...

⭐ 0· 45·0 current·0 all-time
by@imo14reifey
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The skill is a TopMediai/NemoVideo music generator and only requests a single service credential (NEMO_TOKEN) and a config path (~/.config/nemovideo/) which match the described behavior (creating sessions, uploading video, requesting audio). There are no unrelated env vars or binaries requested.
ℹ
Instruction Scope
Instructions mainly describe authenticating, creating a session, uploading video, and using server-sent events for generation — all within scope. Two items to be aware of: (1) the skill instructs constructing a claim URL that includes the token as a query parameter (token=$TOKEN), which can expose the token in logs/referrers if opened in a browser; and (2) it detects the install path to set X-Skill-Platform (probing expected filesystem locations), which is minor telemetry but does read local paths.
✓
Install Mechanism
This is instruction-only with no install steps or downloaded code, so there is no installer risk. Nothing will be written beyond the config files the skill itself instructs it may create in ~/.config/nemovideo/.
✓
Credentials
Only NEMO_TOKEN is required (declared as primaryEnv) and a small config directory. That is proportional for a third-party API service used to generate and deliver tracks. No unrelated secrets or multiple credentials are requested.
ℹ
Persistence & Privilege
The skill is not force-included (always: false) and will run only when invoked. It does store a client_id file (UUID) in ~/.config/nemovideo/ and expects to persist session_id; storing small config files in that directory is reasonable, but users should be aware session tokens may be persisted locally.
Assessment
This skill appears to be what it says: it uploads video to NemoVideo and uses NEMO_TOKEN to create sessions and return generated audio. Before installing, consider: (1) you will be uploading video content to a third-party service — avoid uploading sensitive/private footage unless you trust the service and its privacy terms; (2) the skill may persist a client_id and session information under ~/.config/nemovideo/ — review and remove those files when you stop using the skill if desired; (3) the claim URL template includes the token as a query parameter which can leak the token via browser referrers or logs — avoid sharing that link and prefer server-side handoffs if possible; (4) ensure the NEMO_TOKEN you provide is limited in scope (short-lived or dedicated to this skill) rather than a broader account credential. If you want higher assurance, ask the skill author for exact locations where session tokens are stored and for details on token lifetime and revocation.

Like a lobster shell, security has layers — review code before you run it.

latestvk97b00d7cpk3r5sqdbnt5wdvcn83yv5x

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments