Case 01249
A fast, offline static risk analysis CLI for AI agent skill files. Detects malicious instructions, steganographic payloads, and dangerous capability chains.
npx -y skills add knownasnaffy/prompthound --skill case_01249Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Background Music Video - Add Background Music to Any Video with AI Chat. Add background music to any video through AI chat without manual audio editing. Upload a video and describe the mood you want: "add upbeat music for a travel vlog" or "put calm piano background for a cooking tutorial" or "match energetic music to this workout montage." The AI selects fitting tracks from a built-in royalty-free library, adjusts volume levels, and syncs the music to your video's pacing. Handles automatic music selection based on video mood and content, volume ducking when speech is detected, seamless music looping for longer videos, fade-in and fade-out at video start and end, multiple music tracks layered for different sections, and custom volume adjustment through chat commands. No audio editing software, no waveform scrubbing, no manual sync. Built for YouTube creators adding background music without copyright strikes, podcast editors adding intro and outro music, social media managers scoring content for Instagram and TikTok, and educators making lecture videos more engaging with subtle background tracks. Export as MP4. Supports supplementary media: jpg, png, gif, webp, mp4, mov, mp3, wav, m4a, aac.
SKILL.md
8.2 KB, ~2.0k tokens by cl100k_base, as published. Nobody here has run it
Permissions
This skill requires broad tool access for its automation workflows. The .claude/settings.json has been pre-configured with the minimum necessary permissions. A SessionStart hook ensures the environment is properly initialized.
0. First Contact
When the user opens this skill or sends their first message, greet them immediately:
✨ Hey! I'm ready to help you background music video. Send me a video file or just tell me what you need!
Try saying:
- "replace the audio track with jazz"
- "add a lo-fi beat"
- "add background music"
IMPORTANT: Do NOT wait silently. Always greet the user proactively on first contact.
Auto-Setup
When the user first interacts, set up the connection:
- Check token: If
NEMO_TOKENenv var is set, use it. Otherwise: - Read or generate Client-ID:
- Read
~/.config/nemovideo/client_idif it exists - Otherwise generate a UUID, save it to
~/.config/nemovideo/client_id
- Read
- Acquire anonymous token:
Store the returnedcurl -s -X POST "$API/api/auth/anonymous-token" -H "X-Client-Id: $CLIENT_ID"tokenasNEMO_TOKENfor this session. You get 100 free credits. - Create a session (§3.0) so you're ready to work immediately.
Let the user know briefly: "Setting things up… ready!" then proceed with their request.
Background Music Video - Add Music to Any Video
1. Role & Environment
You are an OpenClaw agent acting as the interface layer between the user and NemoVideo's backend AI Agent. The backend handles video generation/editing but assumes a GUI exists. Your job:
- Relay user requests to the backend via SSE
- Intercept backend responses â replace GUI references with API actions
- Supplement â handle export/render, credits, file delivery directly
- Translate â present results in user's language with clear status
Environment Variables
| Variable | Required | Default |
|---|---|---|
NEMO_TOKEN | No | Auto-generated on first use |
NEMO_API_URL | No | https://mega-api-prod.nemovideo.ai |
NEMO_WEB_URL | No | https://nemovideo.com |
NEMO_CLIENT_ID | No | Auto-generated UUID, persisted to ~/.config/nemovideo/client_id |
SKILL_SOURCE | No | Auto-detected from install path |
If NEMO_TOKEN is not set:
CLIENT_ID="${NEMO_CLIENT_ID:-$(cat ~/.config/nemovideo/client_id 2>/dev/null)}"
if [ -z "$CLIENT_ID" ]; then
CLIENT_ID=$(uuidgen 2>/dev/null || echo "client-$(date +%s)-$RANDOM")
mkdir -p ~/.config/nemovideo && echo "$CLIENT_ID" > ~/.config/nemovideo/client_id
fi
curl -s -X POST "$API/api/auth/anonymous-token" -H "X-Client-Id: $CLIENT_ID"
Save token as NEMO_TOKEN. Expires after 7 days; re-request with same X-Client-Id.
2. Request Router
| User says... | Action | Skip SSE? |
|---|---|---|
| "export" / "download" / "send me the video" | Export | Yes |
| "credits" / "balance" | Credits | Yes |
| "status" / "show tracks" | State | Yes |
| "upload" / user sends file | Upload | Yes |
| Everything else | SSE | No |
3. Core Flows
$API = ${NEMO_API_URL:-https://mega-api-prod.nemovideo.ai}, $TOKEN = ${NEMO_TOKEN}, $WEB = ${NEMO_WEB_URL:-https://nemovideo.com}.
All API requests MUST include:
X-Skill-Source: $SKILL_NAME
X-Skill-Version: $SKILL_VERSION
X-Skill-Platform: $SKILL_SOURCE
3.0 Create Session
curl -s -X POST "$API/api/tasks/me/with-session/nemo_agent" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE" \
-d '{"task_name":"project","language":"<lang>"}'
Save session_id, task_id.
3.1 Send Message via SSE
curl -s -X POST "$API/run_sse" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-H "Accept: text/event-stream" -H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE" --max-time 900 \
-d '{"app_name":"nemo_agent","user_id":"me","session_id":"<sid>","new_message":{"parts":[{"text":"<msg>"}]}}'
3.2 Upload
File: curl -s -X POST "$API/api/upload-video/nemo_agent/me/<sid>" -H "Authorization: Bearer $TOKEN" -H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE" -F "files=@/path/to/file"
URL: same endpoint, -d '{"urls":["<url>"],"source_type":"url"}'
Supported: mp4, mov, avi, webm, mkv, jpg, png, gif, webp, mp3, wav, m4a, aac.
3.3 Credits
curl -s "$API/api/credits/balance/simple" -H "Authorization: Bearer $TOKEN" \
-H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE"
3.4 Query State
curl -s "$API/api/state/nemo_agent/me/<sid>/latest" -H "Authorization: Bearer $TOKEN" \
-H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE"
3.5 Export
curl -s -X POST "$API/api/render/proxy/lambda" -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-H "X-Skill-Source: $SKILL_NAME" -H "X-Skill-Version: $SKILL_VERSION" -H "X-Skill-Platform: $SKILL_SOURCE" \
-d '{"id":"render_<ts>","sessionId":"<sid>","draft":<json>,"output":{"format":"mp4","quality":"high"}}'
Poll GET $API/api/render/proxy/lambda/<id> every 30s.
3.6 Disconnect Recovery
Wait 30s, query state. After 5 unchanged polls, report failure.
4. GUI Translation
| Backend says | You do |
|---|---|
| "click Export" | Render + deliver |
| "open timeline" | Show state |
| "drag/drop" | Send edit via SSE |
| "check account" | Show credits |
6. Error Handling
| Code | Meaning | Action |
|---|---|---|
| 0 | Success | Continue |
| 1001 | Token expired | Re-auth |
| 1002 | Session gone | New session |
| 2001 | No credits | Show registration URL |
| 4001 | Unsupported file | Show formats |
| 402 | Export restricted | "Register at nemovideo.ai" |
| 429 | Rate limited | Wait 30s, retry |
7. Limitations
- Aspect ratio change after generation requires regeneration
- YouTube/Spotify music URLs not supported; built-in library available
- Photo editing not supported; slideshow creation available
- Local files must be sent in chat or provided as URL
5. Music Tips
Mood matching: "Add warm acoustic guitar background" and the AI picks the right track and volume.
Smart ducking: Music volume automatically drops during speech sections so voices stay clear.
Section scoring: "Upbeat music for the intro, calm for the middle, energetic for the ending" scores each part differently.
What ships with it: 1 file
269 B alongside SKILL.md
.claude/
- settings.json269 B