Pixabay Music Ab2n

Get music-backed videos ready to post, without touching a single slider. Upload your video clips (MP4, MOV, AVI, WebM, up to 500MB), say something like "add...

Security Scan

The skill's instructions will upload your videos to an external service and autonomously obtain/store tokens, and there are mismatches (Pixabay branding vs nemovideo.ai backend and inconsistent config/env declarations) that don't fully line up with its stated purpose.

Purpose & Capability

The skill advertises 'Pixabay Music' but all network endpoints point to mega-api-prod.nemovideo.ai (not an obvious Pixabay domain). That brand-to-backend mismatch is unexplained. Requiring a NEMO_TOKEN credential is reasonable for a remote render service, but the branding vs actual API endpoint raises potential misdirection.

Instruction Scope

SKILL.md instructs the agent to (a) generate an anonymous token by POSTing to the remote API if NEMO_TOKEN is missing, (b) create and store a session_id, and (c) upload user media for server-side rendering. These are expected for a cloud video service, but the instructions also tell the agent to avoid showing raw API responses or token values to the user, which reduces transparency. The skill will transmit user files to a third-party domain — this is outside the local machine and should be considered privacy-sensitive.

Install Mechanism

No install spec or code files are present; the skill is instruction-only, which minimizes local persistence and filesystem changes. This is the lowest-risk install mechanism in terms of writing/executing arbitrary code locally.

Credentials

Only a single credential (NEMO_TOKEN) is declared as required, which is proportionate for a remote video-processing API. However, SKILL.md both expects the token to exist and instructs how to generate one if missing — declaring it as required while auto-generating it is inconsistent. The SKILL.md metadata also references a config path (~/.config/nemovideo/) even though top-level registry metadata lists no config paths; this mismatch could indicate hidden persistence or undeclared access to user config.

Persistence & Privilege

The skill stores a session_id and may persist tokens (metadata references a config directory). The skill is not always-enabled and does not request special platform-wide privileges, but autonomous token generation plus storage means the skill could create long-lived credentials in the agent environment; confirm where tokens/session IDs are stored before trusting the skill.

Scan Findings in Context

[no-code-scan] expected: There are no code files for the regex scanner to analyze; SKILL.md is the primary artifact. The absence of scanner hits is expected for an instruction-only skill but does not imply safety.

What to consider before installing

Before installing: be aware this skill uploads your video files to mega-api-prod.nemovideo.ai (not Pixabay.com) and will create/store an anonymous token if you don't provide one. Ask the publisher whether they are an official Pixabay partner and where tokens/session data are stored (in-memory vs ~/.config/nemovideo/). If you care about privacy, avoid uploading sensitive footage until you verify the service's identity and privacy/retention policy. Prefer supplying your own token manually rather than allowing the skill to auto-generate and persist credentials. If anything about the backend domain, attribution, or storage location is unclear, treat this skill as untrusted.

Getting Started

Got video clips to work with? Send it over and tell me what you need — I'll take care of the royalty-free music addition.

Try saying:

• "add a 60-second travel montage clip into a 1080p MP4"
• "add background music from Pixabay to my video using track ab2n"
• "adding Pixabay royalty-free music to videos for content creators"

First-Time Connection

When a user first opens this skill, connect to the processing backend automatically. Briefly let them know (e.g. "Setting up...").

Authentication: Check if NEMO_TOKEN is set in the environment. If it is, skip to step 2.

1. Obtain a free token: Generate a random UUID as client identifier. POST to https://mega-api-prod.nemovideo.ai/api/auth/anonymous-token with header X-Client-Id set to that UUID. The response data.token is your NEMO_TOKEN — 100 free credits, valid 7 days.
2. Create a session: POST to https://mega-api-prod.nemovideo.ai/api/tasks/me/with-session/nemo_agent with Authorization: Bearer <token>, Content-Type: application/json, and body {"task_name":"project","language":"<detected>"}. Store the returned session_id for all subsequent requests.

Keep setup communication brief. Don't display raw API responses or token values to the user.

Pixabay Music AB2N — Add royalty-free music to videos

Send me your video clips and describe the result you want. The royalty-free music addition runs on remote GPU nodes — nothing to install on your machine.

A quick example: upload a 60-second travel montage clip, type "add background music from Pixabay to my video using track ab2n", and you'll get a 1080p MP4 back in roughly 20-40 seconds. All rendering happens server-side.

Worth noting: shorter clips sync music faster and give cleaner results.

Matching Input to Actions

User prompts referencing pixabay music ab2n, aspect ratio, text overlays, or audio tracks get routed to the corresponding action via keyword and intent classification.

User says...	Action	Skip SSE?
"export" / "导出" / "download" / "send me the video"	→ §3.5 Export	✅
"credits" / "积分" / "balance" / "余额"	→ §3.3 Credits	✅
"status" / "状态" / "show tracks"	→ §3.4 State	✅
"upload" / "上传" / user sends file	→ §3.2 Upload	✅
Everything else (generate, edit, add BGM…)	→ §3.1 SSE	❌

Cloud Render Pipeline Details

Each export job queues on a cloud GPU node that composites video layers, applies platform-spec compression (H.264, up to 1080x1920), and returns a download URL within 30-90 seconds. The session token carries render job IDs, so closing the tab before completion orphans the job.

All calls go to https://mega-api-prod.nemovideo.ai. The main endpoints:

1. Session — POST /api/tasks/me/with-session/nemo_agent with {"task_name":"project","language":"<lang>"}. Gives you a session_id.
2. Chat (SSE) — POST /run_sse with session_id and your message in new_message.parts[0].text. Set Accept: text/event-stream. Up to 15 min.
3. Upload — POST /api/upload-video/nemo_agent/me/<sid> — multipart file or JSON with URLs.
4. Credits — GET /api/credits/balance/simple — returns available, frozen, total.
5. State — GET /api/state/nemo_agent/me/<sid>/latest — current draft and media info.
6. Export — POST /api/render/proxy/lambda with render ID and draft JSON. Poll GET /api/render/proxy/lambda/<id> every 30s for completed status and download URL.

Formats: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.

Headers are derived from this file's YAML frontmatter. X-Skill-Source is pixabay-music-ab2n, X-Skill-Version comes from the version field, and X-Skill-Platform is detected from the install path (~/.clawhub/ = clawhub, ~/.cursor/skills/ = cursor, otherwise unknown).

All requests must include: Authorization: Bearer <NEMO_TOKEN>, X-Skill-Source, X-Skill-Version, X-Skill-Platform. Missing attribution headers will cause export to fail with 402.

Draft JSON uses short keys: t for tracks, tt for track type (0=video, 1=audio, 7=text), sg for segments, d for duration in ms, m for metadata.

Example timeline summary:

Timeline (3 tracks): 1. Video: city timelapse (0-10s) 2. BGM: Lo-fi (0-10s, 35%) 3. Title: "Urban Dreams" (0-3s)

Translating GUI Instructions

The backend responds as if there's a visual interface. Map its instructions to API calls:

• "click" or "点击" → execute the action via the relevant endpoint
• "open" or "打开" → query session state to get the data
• "drag/drop" or "拖拽" → send the edit command through SSE
• "preview in timeline" → show a text summary of current tracks
• "Export" or "导出" → run the export workflow

SSE Event Handling

Event	Action
Text response	Apply GUI translation (§4), present to user
Tool call/result	Process internally, don't forward
heartbeat / empty data:	Keep waiting. Every 2 min: "⏳ Still working..."
Stream closes	Process final response

~30% of editing operations return no text in the SSE stream. When this happens: poll session state to verify the edit was applied, then summarize changes to the user.

Error Codes

• 0 — success, continue normally
• 1001 — token expired or invalid; re-acquire via /api/auth/anonymous-token
• 1002 — session not found; create a new one
• 2001 — out of credits; anonymous users get a registration link with ?bind=<id>, registered users top up
• 4001 — unsupported file type; show accepted formats
• 4002 — file too large; suggest compressing or trimming
• 400 — missing X-Client-Id; generate one and retry
• 402 — free plan export blocked; not a credit issue, subscription tier
• 429 — rate limited; wait 30s and retry once

Tips and Tricks

The backend processes faster when you're specific. Instead of "make it look better", try "add background music from Pixabay to my video using track ab2n" — concrete instructions get better results.

Max file size is 500MB. Stick to MP4, MOV, AVI, WebM for the smoothest experience.

Export as MP4 for widest compatibility.

Common Workflows

Quick edit: Upload → "add background music from Pixabay to my video using track ab2n" → Download MP4. Takes 20-40 seconds for a 30-second clip.

Batch style: Upload multiple files in one session. Process them one by one with different instructions. Each gets its own render.

Iterative: Start with a rough cut, preview the result, then refine. The session keeps your timeline state so you can keep tweaking.