AIML Music Generator

• Analyzed: May 11, 2026, 4:50 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3b155ca493b422c8ff292800c025dc3b75335b1126a0911299f985a98dfa7009
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential arbitrary file write vulnerability. The `scripts/gen_music.py` script allows the `--out-dir` argument to specify an arbitrary directory for saving the generated MP3 file. While the filename itself is fixed (`music_{gen_id}.mp3`), an attacker could potentially use this to write files to sensitive locations (e.g., `/tmp`, web server directories, or even attempt system directories if permissions allow) if the OpenClaw agent does not properly sanitize or restrict user input for this argument. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or backdoor installation.