T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gen_music.py:50- Finding
Unvalidated API-Controlled Download URL Enables Blind SSRF and Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Security audit
AIML Music Generator
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently generates music through AIMLAPI, but users should understand that prompts, lyrics, an API key, and downloaded audio pass through external network calls.
Install only if you are comfortable sending music prompts and lyrics to AIMLAPI and using an AIMLAPI_API_KEY from your environment. Avoid including private, secret, or sensitive text in lyrics or prompts, and prefer running it in a normal project directory with spending limits on the API key.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/gen_music.py:34- Finding
Bearer API Key May Be Disclosed Through Cross-Origin HTTP Redirects
- Content
View full analysis
Any: data = json.dumps(payload).encode("utf-8") if payload else None headers = { "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "User-Agent": DEFAULT_USER_AGENT, } req = urllib.request.Request(url, data=data, headers=headers, method=method) try: with urllib.request.urlopen(req) as res: return json.loads(res.read().decode("utf-8")) except urllib.error.HTTPError as e: detail = e.read().decode("utf-8") raise SystemExit(f"API Error ({e.code}): {detail}") ``` ### Technical Analysis The script correctly obtains the API key from the `AIMLAPI_API_KEY` environment variable rather than hardcoding it. Sending that key to the declared AIMLAPI HTTPS endpoint is necessary for the Skill's functionality. However, the request relies on `urllib.request.urlopen` and its automatic redirect behavior without checking the redirect destination. The request includes the bearer credential in the `Authorization` header. Python's standard redirect handling can preserve ordinary request headers across redirects, including redirects to another host. Consequently, if `api.aimlapi.com`, its DNS resolution, its TLS-serving infrastructure, or an upstream component is compromised and responds with a cross-origin HTTP redirect, the client may send the bearer token to the redirected host. The initial endpoint is a fixed HTTPS URL, so exploitation requires compromise or malicious behavior in the trusted API path; this reduces likelihood but does not eliminate the credential-disclosure risk. ### Attack Path 1. The script creates a request to `https://api.aimlapi.c ...[truncated 1011 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill advertises capabilities that include environment access, file writing, and network use, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: an agent may invoke the skill without clear policy constraints, while the script can still access an API key, write output files, and transmit user content to an external service.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The description uses broad trigger language like requests for music, songs, or soundtracks with specific lyrics or styles, which can match many ordinary user prompts. In agent ecosystems, overly broad routing can cause unintended invocation of a networked skill, increasing the chance that user prompts or sensitive text are sent to an external provider without the user realizing it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README explains a network-based generation flow but does not disclose that prompts and lyrics are transmitted to an external API for processing. Because lyrics and prompts may contain copyrighted, personal, confidential, or sensitive content, lack of disclosure undermines informed consent and can lead to unintended data exfiltration to a third party.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import urllib.request from typing import Any DEFAULT_BASE_URL = "https://api.aimlapi.com/v2" DEFAULT_USER_AGENT = "openclaw-skill-aimlapi-music/1.1" def parse_args() -> argparse.Namespace:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script sends user-supplied prompts and optional lyrics to a third-party service for processing, but it does not provide a clear user-facing disclosure at the point of transmission. Because prompts and lyrics may contain sensitive or copyrighted content, this creates a privacy and data-handling risk, especially in an agent context where users may not realize their content leaves the local environment.
- Content
Static analysis
No suspicious patterns detected.