ClawHub

Music Ab2n

v1.0.0

add video or audio files into music-backed videos with this skill. Works with MP4, MOV, AVI, WebM files up to 500MB. content creators use it for adding backg...

⭐ 0· 20·0 current·0 all-time
by@whitejohnk-26
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
Name/description (add background music to videos) aligns with the runtime instructions and the single required credential (NEMO_TOKEN) used to call an external rendering API. Required binaries and overall footprint match the stated cloud-processing purpose.
ℹ
Instruction Scope
Instructions explicitly direct the agent to POST user-supplied media and session requests to https://mega-api-prod.nemovideo.ai and to generate/use an anonymous token if NEMO_TOKEN is not provided. This is expected for a cloud render service but means user files and tokens are transmitted externally. The SKILL.md also describes deriving X-Skill-Platform from install paths (e.g., checking ~/.clawhub/), which implies inspecting local paths — a minor scope expansion not strictly necessary to perform uploads.
✓
Install Mechanism
Instruction-only skill with no install spec or downloaded code. No archives or remote installers are used, so nothing is written to disk by an installer step.
✓
Credentials
Only requests NEMO_TOKEN (primary credential). That matches the documented API authentication model. It also documents an anonymous-token flow to obtain temporary tokens when a token isn't provided. No unrelated secrets or broad environment access are requested.
✓
Persistence & Privilege
always is false and the skill does not request system-wide or cross-skill configuration changes. It asks to persist a session_id for job tracking (normal for a session-based render API).
Assessment
This skill appears to do what it says: it uploads your video/audio to an external render service (mega-api-prod.nemovideo.ai) and returns processed MP4s. Before installing/use: (1) understand that your media and any generated/used tokens will be sent to that third-party domain — do not upload sensitive content you cannot share. (2) Provide either a dedicated NEMO_TOKEN or let the skill use the anonymous-token flow; prefer a disposable token or account if you have privacy concerns. (3) note small inconsistencies: the skill metadata in SKILL.md references a config path (~/.config/nemovideo/) and install-path detection for X-Skill-Platform, which implies the agent may inspect local paths; confirm whether you’re comfortable with that. (4) there is no installable code to review, so you cannot audit implementation details — trust is placed on the external API. If you need higher assurance, ask the publisher for a homepage/source repo, or test with non-sensitive sample files and a disposable token.

Like a lobster shell, security has layers — review code before you run it.

latestvk97fg8kfp9wz60bph17dqecpc98522bs

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
EnvNEMO_TOKEN
Primary envNEMO_TOKEN

Comments