ClawHub
Back to skill

Security audit

Suno提示词工具

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only Suno prompt-writing skill with some broad trigger words and Chinese-focused output, but no evidence of code execution, data access, persistence, or deceptive behavior.

Before installing, be aware that broad trigger words may activate this skill for generic prompt requests, and generated prompt output is designed to include Chinese translations. It does not appear to run code or access private data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger list contains extremely generic terms such as "Prompt", "prompt", and broad music-prompt phrases that are likely to appear in normal conversation. In an agent skill system, this can cause unintended activation, routing user requests into this skill when they were not asking for Suno-specific help, which creates prompt-scope hijacking and reduces user control over tool invocation.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The README instructs users to add “Mandarin”, “Chinese” or “singing in Chinese” when they need a specific output, and the document overall is presented as Chinese-focused guidance without stating that language is optional or user-selected. This can be read as steering toward a specific language/locale without explicit opt-in or a documented regional justification.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger list contains very broad terms such as 'prompt', 'Prompt', and generic music-prompt phrases that are likely to match ordinary conversation unrelated to Suno. This can cause unintended skill invocation, routing users into this skill when they did not request it, which undermines intent matching and can create prompt-scope confusion or policy bypass opportunities through inappropriate tool activation.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file states that every generated English prompt "must" be followed by a Chinese translation, making Chinese output mandatory regardless of the user's preferred language. This imposes a specific language/locale behavior without user opt-in or a clearly documented region-specific justification.

Static analysis

No suspicious patterns detected.