AIML Music Generator

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently generates music through AIMLAPI, with expected API-key use and external prompt/lyrics submission, but users should review the provider and unknown source before installing.

This skill appears safe to install if you intend to generate music through AIMLAPI. Before using it, confirm you trust the registry entry, provide only an AIMLAPI key you are comfortable using for generation, monitor account usage, and avoid sending confidential lyrics or prompts.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill can use the user's AIMLAPI account or billing quota when generating music.

Why it was flagged

The script requires a local AIMLAPI API key and uses it to authorize requests to the music-generation API. This is expected for the stated purpose, but it is still delegated account access.

Skill content

key = os.getenv("AIMLAPI_API_KEY") ... "Authorization": f"Bearer {api_key}"

Recommendation

Use a dedicated or restricted AIMLAPI key if possible, monitor usage, and avoid sharing the key in prompts or logs.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Music descriptions and lyrics entered by the user leave the local environment and are processed by AIMLAPI and its model providers.

Why it was flagged

The script sends the user's prompt and optional lyrics to AIMLAPI, which is a disclosed and purpose-aligned external provider flow.

Skill content

DEFAULT_BASE_URL = "https://api.aimlapi.com/v2" ... payload = {"model": args.model, "prompt": args.prompt} ... if args.lyrics: payload["lyrics"] = args.lyrics

Recommendation

Do not submit sensitive, confidential, or unreleased lyrics unless you are comfortable with AIMLAPI's handling and retention terms.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less external context for verifying the publisher, update history, or upstream project identity.

Why it was flagged

The registry metadata does not provide a source repository or homepage, limiting provenance verification. The included code is visible and aligned with the stated purpose, so this is a provenance note rather than a concern.

Skill content

Source: unknown; Homepage: none

Recommendation

Review the included script before use and prefer installing updates only from trusted registry entries or maintainers.