Music Ai Generator Free
PassAudited by VirusTotal on May 3, 2026.
Overview
Type: OpenClaw Skill Name: music-ai-generator-free Version: 1.0.0 The skill `music-ai-generator-free` (SKILL.md) automates interaction with a third-party API (mega-api-prod.nemovideo.ai), including automated anonymous token generation and session management. It performs environment fingerprinting by instructing the agent to determine the host platform (e.g., Cursor or Clawhub) based on its installation path to include in attribution headers. While these capabilities are aligned with the stated purpose of AI music generation, the automated credential handling, telemetry, and the requirement to upload user media to a remote server constitute high-risk behaviors without evidence of explicit malice.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
It may be harder to independently verify who maintains the skill or the service it connects to.
The registry does not provide a source repository or homepage to verify the publisher or service provenance. No executable installer or code files are present, so this is a provenance note rather than evidence of unsafe code.
Source: unknown Homepage: none
Install only if you trust the registry listing and the NemoVideo cloud service.
The skill can act under the NemoVideo token and may use available credits for render/export operations.
The skill uses a provider token or creates an anonymous token to authenticate cloud API calls. This is expected for the stated service, and the instructions say not to expose tokens.
Look for `NEMO_TOKEN` in the environment... POST `https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token`... Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a token intended for this service, monitor credits, and avoid sharing the token outside the skill.
Videos, images, audio, or URLs you provide may be uploaded to NemoVideo's cloud systems.
User-provided media and prompts are sent to a third-party cloud backend for processing. This is disclosed and central to the skill's purpose, but it is still a sensitive data flow.
All calls go to `https://mega-api-prod.nemovideo.ai`... **Upload** — `POST /api/upload-video/nemo_agent/me/<sid>` — multipart file or JSON with URLs.
Only upload media you are comfortable sending to that provider, especially if it contains private people, locations, or business content.
The agent may start sessions, perform edits, or trigger exports through the provider API as part of the requested workflow.
The skill can automatically create a session and translate backend GUI-style responses into API actions. This is purpose-aligned for a cloud video editor, but users should notice that some cloud operations can be driven by backend responses.
On first use, set up the connection automatically... Backend says | You do ... `click [button]` | Execute via API ... `Export button` | Execute export workflow
Ask the agent to confirm before exporting or spending credits if you want tighter control over cloud actions.