Suno Ai Online

Turn a short poem or set of lyrics about summer nights into 1080p AI music videos just by typing what you need. Whether it's generating original songs from t...

Security Scan

The skill's described purpose (cloud AI music/video generation) matches the API calls and single credential it requests, but there are small inconsistencies and a few operational details that deserve caution before installing.

Purpose & Capability

The skill claims to generate songs/videos and only requests a single service token (NEMO_TOKEN) and uses a Nemovideo API — this is coherent. However the SKILL.md frontmatter includes a config path (~/.config/nemovideo/) while the registry metadata lists no required config paths; that mismatch should be clarified (why the skill would need local config files).

Instruction Scope

Instructions are explicit about authenticating, opening sessions, uploading files, streaming SSE, polling render status, and returning download URLs — all expected for a cloud render API. The agent is told to generate anonymous tokens and persist session_id and token for requests (but not to print them). The SKILL.md also asks to 'auto-detect' platform from an install path for an attribution header, which may require reading the agent's install/runtime path; this is scope creep compared with purely API-driven behavior and should be justified.

Install Mechanism

There is no install spec and no code files; this is an instruction-only skill, so nothing will be written to disk by an installer — low install risk.

Credentials

Only one credential (NEMO_TOKEN) is required, which is proportionate to a cloud API client. However the SKILL.md metadata references a config path (~/.config/nemovideo/) that would grant access to a local config directory; the top-level registry says none. Confirm whether the skill needs to read local config files and why. Also confirm whether tokens obtained via the anonymous endpoint are short-lived and limited.

Persistence & Privilege

The skill is not always-enabled and uses normal autonomous invocation. It does not request system-wide privileges in the manifest. Minor concern: instructions about auto-detecting the platform via install path could require reading agent or filesystem paths; this is not a broad privilege request but should be clarified.

What to consider before installing

This skill appears to do what it says (call a Nemovideo render API using NEMO_TOKEN), but verify a few things before installing: 1) Confirm the skill author/source and trustworthiness of https://mega-api-prod.nemovideo.ai (no homepage or maintainer listed). 2) Ask whether the referenced ~/.config/nemovideo/ is actually needed and what it contains; avoid giving the agent access to local config directories unless necessary. 3) Understand the token type: anonymous tokens can be created by the skill — ensure they are short-lived and limited; do not supply long-lived/privileged credentials in NEMO_TOKEN. 4) Be aware the skill will upload user files to the remote service for rendering; do not upload sensitive material. 5) If you need higher assurance, request the skill author or registry to clarify the configPath usage, supply a trustworthy homepage/source, and provide example API responses or an official SDK reference — those would increase confidence.

Getting Started

Share your text or lyrics and I'll get started on AI music generation. Or just tell me what you're thinking.

Try saying:

• "generate my text or lyrics"
• "export 1080p MP4"
• "generate a 60-second pop song with"

Automatic Setup

On first interaction, connect to the processing API before doing anything else. Show a brief status like "Setting things up...".

Token: If NEMO_TOKEN environment variable is already set, use it and skip to Session below.

Free token: Generate a UUID as client identifier, then POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id: <uuid>. The response field data.token becomes your NEMO_TOKEN (100 credits, 7-day expiry).

Session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Bearer auth and body {"task_name":"project"}. Save session_id from the response.

Confirm to the user you're connected and ready. Don't print tokens or raw JSON.

Suno AI Online — Generate songs from text prompts

This tool takes your text or lyrics and runs AI music generation through a cloud rendering pipeline. You upload, describe what you want, and download the result.

Say you have a short poem or set of lyrics about summer nights and want to generate a 60-second pop song with upbeat tempo from these lyrics — the backend processes it in about 30-60 seconds and hands you a 1080p MP4.

Tip: shorter and more specific prompts tend to produce more focused, usable results.

Matching Input to Actions

User prompts referencing suno ai online, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

Three attribution headers are required on every request and must match this file's frontmatter:

Header	Value
X-Skill-Source	suno-ai-online
X-Skill-Version	frontmatter version
X-Skill-Platform	auto-detect: clawhub / cursor / unknown from install path

Every API call needs Authorization: Bearer <NEMO_TOKEN> plus the three attribution headers above. If any header is missing, exports return 402.

API base: https://mega-api-prod.nemovideo.ai

Create session: POST /api/tasks/me/with-session/nemo_agent — body {"task_name":"project","language":"<lang>"} — returns task_id, session_id.

Send message (SSE): POST /run_sse — body {"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}} with Accept: text/event-stream. Max timeout: 15 minutes.

Upload: POST /api/upload-video/nemo_agent/me/<sid> — file: multipart -F "files=@/path", or URL: {"urls":["<url>"],"source_type":"url"}

Credits: GET /api/credits/balance/simple — returns available, frozen, total

Session state: GET /api/state/nemo_agent/me/<sid>/latest — key fields: data.state.draft, data.state.video_infos, data.state.generated_media

Export (free, no credits): POST /api/render/proxy/lambda — body {"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}. Poll GET /api/render/proxy/lambda/<id> every 30s until status = completed. Download URL at output.url.

Supported formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

Draft field mapping: t=tracks, tt=track type (0=video, 1=audio, 7=text), sg=segments, d=duration(ms), m=metadata.

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Common Workflows

Quick edit: Upload → "generate a 60-second pop song with upbeat tempo from these lyrics" → Download MP4. Takes 30-60 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "generate a 60-second pop song with upbeat tempo from these lyrics" — concrete instructions get better results.

Max file size is 200MB. Stick to MP3, WAV, MP4, WebM for the smoothest experience.

Export as MP4 to keep audio and visual elements together for easy sharing.