Free Music Video Ai Generator
PassAudited by VirusTotal on May 5, 2026.
Overview
Type: OpenClaw Skill Name: free-music-video-ai-generator Version: 1.0.0 The skill is a functional wrapper for an AI video generation service hosted at nemovideo.ai. It manages authentication via environment variables or anonymous tokens, handles file uploads, and polls a cloud rendering API for video processing. While it performs platform detection (checking install paths like ~/.cursor/skills/) and requires network access, these behaviors are documented and directly support the stated purpose of generating and exporting music videos. No evidence of data exfiltration, unauthorized command execution, or malicious prompt injection was found.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A token could be used to create sessions, check credits, upload files, and render jobs on the service.
The skill uses a bearer token to authorize all backend requests. That is expected for a provider integration, but it means the agent can act within the user’s NemoVideo session/credit boundary.
Every API call needs `Authorization: Bearer <NEMO_TOKEN>`
Use a dedicated token if possible, do not expose it in chat or logs, and monitor credit/subscription usage.
Audio, video, images, prompts, and generated output metadata may leave the local environment and be processed by the NemoVideo service.
The workflow sends user media or URLs to a third-party cloud backend. This is central to the skill’s purpose, but it is a meaningful data-sharing boundary.
**Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"],"source_type":"url"}`Only upload files you are comfortable sharing with that provider, and check the provider’s privacy, retention, and copyright terms before using sensitive or proprietary media.
If the backend returns unexpected GUI-style instructions, the agent may run service actions such as status checks or export steps without explaining each technical call.
Backend text can cause the agent to take follow-up service actions. The actions are constrained to the video-generation workflow, so this is a note rather than a concern.
The backend responds as if there's a visual interface. Map its instructions to API calls: ... 'click' or '点击' → execute the action via the relevant endpoint ... 'Export' or '导出' → run the export workflow
Keep actions tied to the user’s request and ask for confirmation before uploads, exports, or any action that could consume credits or finalize output.