Music Generator Free Easy

ReviewAudited by ClawScan on May 4, 2026.

Overview

The skill is a coherent cloud music/video generation wrapper, but users should notice that prompts/media are sent to an external NemoVideo API using a bearer token and that licensing claims are not backed by included terms.

This skill appears purpose-aligned and does not include local code or install-time execution. Before installing, be comfortable with sending prompts and any uploaded media to the NemoVideo cloud API, use a limited token if possible, and independently verify copyright or royalty-free terms before using generated music publicly.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Requests and render jobs are made under the token used by the skill, which may associate activity or credit usage with that token.

Why it was flagged

The skill uses a bearer token, or creates an anonymous token if one is not present, to make cloud API requests. This is expected for the stated service but grants session and credit authority to the backend.

Skill content
If `NEMO_TOKEN` is in the environment, use it directly... Include `Authorization: Bearer <NEMO_TOKEN>` and all attribution headers on every request
Recommendation

Use a dedicated or limited token when possible, do not paste the token into chat, and rotate or revoke it if you no longer trust the skill or provider.

What this means

Any prompt or media you provide for generation may leave your local environment and be processed by NemoVideo's cloud service.

Why it was flagged

The skill sends prompts, uploaded files or URLs, session state, and render/export requests to an external cloud API. This is disclosed and purpose-aligned, but it is a third-party data boundary.

Skill content
API base: `https://mega-api-prod.nemovideo.ai` ... **Upload**: POST `/api/upload-video/nemo_agent/me/<sid>` — file: multipart `-F "files=@/path"`, or URL: `{"urls":["<url>"]...}`
Recommendation

Only upload files or prompts you are comfortable sending to the external provider, and review the provider's terms if the content is sensitive or commercial.

What this means

During a generation task, the agent may perform internal upload, state, or export calls without asking for separate approval for every backend step.

Why it was flagged

The skill allows backend GUI-style responses to drive follow-up API calls. This is part of the intended workflow, but it means some service actions may be triggered automatically within the session.

Skill content
The backend responds as if there's a visual interface. Map its instructions to API calls: - "click" or "点击" → execute the action via the relevant endpoint ... - "Export" or "导出" → run the export workflow
Recommendation

If you want more control, ask the agent to confirm before uploads or exports, especially when using private media.

What this means

Users might assume generated tracks are safe for public or commercial use without checking the actual license.

Why it was flagged

The skill makes broad royalty-free and copyright-safety claims, but the supplied artifacts do not include licensing terms or a provider homepage to substantiate those claims.

Skill content
"generate a 30-second royalty-free background track for my video" ... "generating free background music for videos without copyright issues"
Recommendation

Verify the provider's license and usage terms before publishing or monetizing generated music.