Ai Music Generator Free
v1.0.0Tell me what you need and I'll compose original, royalty-free music tailored to your exact vibe, tempo, and style. This ai-music-generator-free skill lets yo...
⭐ 0· 39·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (AI music generator) align with the declared requirements and runtime instructions: the skill talks to the NemoVideo API, uploads video, creates sessions, and returns generated audio. Requiring a single NEMO_TOKEN and a local client_id file matches the described functionality.
Instruction Scope
The SKILL.md instructs the agent to create/retain a client_id in ~/.config/nemovideo/, obtain an anonymous token from the Nemo API if NEMO_TOKEN is missing, create sessions, upload files, and return links. These actions are within the service scope but include two points to watch: (1) the guidance to generate and store tokens/session IDs on disk, and (2) the instruction to provide a 'claim' URL that embeds the token as a query parameter (this risks token exposure via browser history, logs, or referrers).
Install Mechanism
Instruction-only skill with no install spec or downloaded code; nothing will be written beyond config files the SKILL.md explicitly names. This minimizes install-time risk.
Credentials
Only a single credential (NEMO_TOKEN) is declared as required, which is proportionate. However, the skill will attempt to obtain and use an anonymous token if none is set and will persist identifiers/session data under ~/.config/nemovideo/. The practice of embedding the token into a public claim URL is unnecessary for core functionality and increases leakage risk.
Persistence & Privilege
The skill does persist small files (client_id, session_id) under ~/.config/nemovideo/, which matches metadata. It does not request always:true or other elevated privileges, nor does it modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says: it talks to the NemoVideo API to generate music and stores small config data under ~/.config/nemovideo/. Before installing, consider: (1) Limit exposure of your primary credentials — avoid using a high-privilege or long-lived token as NEMO_TOKEN; prefer a restricted or ephemeral token. (2) The skill instructs the agent to create a claim link that embeds the token in the URL — this can leak tokens via browser history, logs, or referer headers. If you care about token privacy, avoid sharing such links or request the vendor change to a token-less claim flow. (3) Inspect the ~/.config/nemovideo/ files after first-run to see what is written and remove tokens if you stop using the skill. (4) Because this is instruction-only, no third-party code is installed locally, but the skill will make network calls to the api domain listed; verify you trust nemovideo.com and their privacy/terms. If any of these points are unacceptable, do not install or provide a reusable/privileged NEMO_TOKEN.Like a lobster shell, security has layers — review code before you run it.
latestvk97a5fvfhpjnqdeadjzb3pc7s583ynxa
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN