Pixabay Music

v1.0.0

Tired of hunting through endless music libraries just to find a track that fits your video's mood? The pixabay-music skill connects your video workflow direc...

0· 40·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
The skill claims to search Pixabay music but does so via NemoVideo's backend (mega-api-prod.nemovideo.ai). Requesting a NEMO_TOKEN and using ~/.config/nemovideo/ is coherent for a NemoVideo integration. No unrelated credentials or binaries are required.
Instruction Scope
Runtime instructions include reading/writing ~/.config/nemovideo/client_id, obtaining an anonymous token if NEMO_TOKEN is absent, creating sessions, uploading user video files, and generating a workspace claim URL containing the token and session. These actions are within scope for a 'apply music to video' workflow, but they do involve uploading user video content and creating URLs that embed tokens (potential token exposure via logs/referrers). The SKILL.md explicitly asks not to expose tokens in output, which mitigates but does not eliminate risk.
Install Mechanism
Instruction-only skill with no install steps or code files; nothing is downloaded or written beyond the described client_id file. This is the lowest-risk install surface.
Credentials
Only NEMO_TOKEN is required (declared as primaryEnv) and configPaths include ~/.config/nemovideo/, which matches the described behavior. This is proportionate. However, because the backend will receive uploaded videos and metadata, users should consider privacy implications of sending media to an external service.
Persistence & Privilege
The skill is not always-enabled and does not request elevated system privileges. It can be invoked autonomously (default), which is normal for skills; there is no evidence it modifies other skills or system-wide settings.
Assessment
This skill appears to do what it says, but note these practical considerations before installing: - The skill sends your videos and related metadata to NemoVideo's backend (mega-api-prod.nemovideo.ai) to fetch Pixabay tracks and to perform edits — don't upload sensitive or private footage unless you trust NemoVideo's policies. - It requires a NEMO_TOKEN (Bearer token). If you don't already have one it will create/save a small client_id in ~/.config/nemovideo/ and obtain an anonymous token. Treat that token like a password: don't paste it into public places. - The skill may generate shareable links containing the token and session id. Such links can leak tokens via logs or referrers — avoid sharing them publicly and delete/revoke tokens if you suspect exposure. - Because this is an instruction-only skill, review NemoVideo's privacy/terms and consider testing with non-sensitive sample videos first. If you want stronger guarantees, request a version that explicitly documents token lifecycle, data retention, and how to revoke tokens. - Confidence is medium: the skill is internally coherent, but installing any skill that uploads files to an external service carries privacy risk; ask the publisher for a privacy/data-handling statement if that matters to you.

Like a lobster shell, security has layers — review code before you run it.

latestvk9721rpe57y0sv31wxdc2v32e183y1cn

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments