Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AceDataCloud music-generation API guide with expected external API use and no hidden execution or persistence.
Before installing, confirm you trust @acedatacloud and are comfortable sending prompts, lyrics, audio IDs, and reference audio URLs to AceDataCloud. Use a dedicated API key if possible, restrict allowed APIs to the workflows you need, monitor billing, and avoid submitting confidential or rights-sensitive material unless you have approval.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
metadata:
author: acedatacloud
version: "1.0"
compatibility: Requires ACEDATACLOUD_API_TOKEN in .env file (get an API key at https://platform.acedata.cloud/console/applications).
---
# Producer Music Generation
The manifest-style description says to use the skill when creating songs, generating lyrics, extending tracks, creating covers, swapping vocals/instrumentals, replacing sections, or uploading reference audio. This is a wide natural-language activation scope with no explicit trigger phrases, constraints, or negative examples, which could cause unintended invocation for general music-related requests.
The skill sends prompts, lyrics, and potentially uploaded reference audio to a third-party API, but the setup and workflow docs do not clearly warn users that their content leaves the local environment. In this context, that omission is security-relevant because users may unknowingly transmit copyrighted, confidential, or sensitive audio/text to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acedata.cloud/producer/audios \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"action": "generate", "lyric": "", "prompt": "upbeat electronic dance track with synth leads"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X POST https://api.acedata.cloud/producer/audios \
-H "Authorization: Bearer $ACEDATACLOUD_API_TOKEN" \
-H "Content-Type: application/json" \
-d '{"action": "generate", "lyric": "", "prompt": "upbeat electronic dance track with synth leads"}'
The manifest description focuses on creating songs, lyrics, covers, edits, swaps, and reference-audio uploads, but the file also documents separate capabilities for stem separation, WAV retrieval, and video generation/download. Those are related to music production, but they are still additional behaviors not reflected in the concise manifest summary.
The setup instructions tell users to include only two allowed API routes, but the rest of the document presents other endpoints like /producer/lyrics, /producer/wav, /producer/videos, and /producer/upload as supported workflows. This is not merely incomplete documentation: it can mislead users into configuring access that contradicts the documented feature set.
No suspicious patterns detected.