suno-lyrics-to-song

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:10 AM UTC
• Version: 0.1.9

Overview

This is a disclosed song-generation skill, but it uses a broad persistent Beatra credential and silent package self-updates that go beyond the narrow lyrics-to-song purpose.

Install only if you are comfortable granting this Beatra skill a shared, broad device credential, allowing paid music generation after one final production-card approval, sending limited installation/platform metadata to Beatra, and accepting silent package updates unless you disable them with the documented update --auto off command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares a narrow lyrics-to-song purpose, but its documented capabilities include shell, file read/write, environment access, and network operations without any explicit permission declaration or user-facing scoping. This increases attack surface and makes it harder for users or the host to understand that the skill can modify local state, store credentials, and communicate remotely.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared functionality is lyric transformation and song generation, but the skill also performs authentication, persistent credential storage, remote tool invocation, file uploads, telemetry/registration, uninstall token revocation, and self-update/package replacement. That mismatch is dangerous because users may consent to a benign-seeming creative tool while unknowingly granting a much broader trusted runtime with access to local state and remote accounts.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: A lyrics-generation skill silently self-updating its installed package materially changes code after installation, which creates a supply-chain and trust-boundary risk even if the update path claims verification. The danger is heightened because the update occurs before ordinary commands and without point-of-use consent, letting new behavior be introduced under the guise of a simple content tool.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Automatic package download and replacement is not necessary to fulfill the core function of restructuring lyrics into a Suno-ready song, so embedding that capability violates least privilege. Unnecessary update/write capability expands the blast radius of compromise and enables local code changes unrelated to the user's creative request.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The authorization flow requests an unusually broad OAuth scope set, including artifacts, images, videos, speech, voices, wallet spending, and task controls, which are not necessary for a lyrics-to-song skill. If the token is compromised or the service behaves unexpectedly, the granted credential could be abused far beyond the stated skill purpose, violating least privilege and increasing blast radius.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script fingerprints the host agent platform from environment variables and captures the device hostname for transmission/storage, despite this not being clearly required to convert lyrics into songs. This expands data collection beyond functional necessity and may expose agent/tooling identity and host metadata that can aid profiling, targeting, or correlation across installations.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script maintains a local inventory of installed skills and their absolute installation paths, which is unrelated to the core lyrics-to-song function. Even if stored locally, this creates unnecessary sensitive metadata about a user's environment that could later be read by other components or exposed through compromise, enabling profiling of installed capabilities and filesystem layout.

Description-Behavior Mismatch

High

• Confidence: 91% confidence
• Finding: The client implements broad self-update, package replacement, inventory, and telemetry behavior that is unrelated to a lyrics-to-song skill's stated purpose. In this context, that extra capability materially enlarges the trust boundary: a songwriting helper can silently fetch and install new code, turning a low-risk content tool into a persistent code delivery mechanism.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code fingerprints the host agent environment using environment variables and local metadata to derive a platform identifier. For a songwriting skill this collection is unnecessary and creates privacy and tracking risk, especially when combined with registration telemetry.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill records local installation inventory and sends installation registration telemetry that is unrelated to transforming lyrics into songs. This creates persistent metadata about installed skills and host platform, enabling device profiling and remote visibility beyond the user's reasonable expectations for this skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Silent automatic updates that modify installed files without a user-facing warning undermine informed consent and make forensic review harder, because the behavior of the skill may change between invocations. Even if updates are authenticated, silent code changes are risky in an agent context where the skill can access local files, credentials, shell, and network resources.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document states that the client silently checks for and automatically installs newer releases by default, without separate confirmation. Even with integrity checks and rollback protections, default silent self-update changes installed code on the user's system without an explicit just-in-time consent step, which creates supply-chain and unexpected system-modification risk if the update channel is compromised or the behavior is not clearly surfaced to users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly describes automatic outbound installation registration and local cache writes occurring on first use without any mention of a user-facing notice, consent flow, or opt-out. Even if the payload is described as non-secret and non-billable, it still transmits environment-linked metadata and persists local state, which creates a privacy and transparency issue and can violate user expectations or organizational policy.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The workflow allows activation with very little user input and explicitly says that if the user provides only a topic or story idea, only one lyric line or hook is needed before proceeding. In a paid-generation skill, broad start conditions increase the chance the agent will move users into a billable workflow without clear informed intent, especially when combined with later instructions that approval of a production card authorizes purchase.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file states that approval of the production card both accepts lyric edits and authorizes a paid generation, and also forbids asking for another confirmation before execution. This is dangerous because it collapses content approval and spending consent into one step, making accidental or ambiguous authorization more likely and reducing the user's ability to distinguish review from purchase.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script requests broad privileged scopes but does not clearly warn the user in its output or documentation that authorization includes capabilities far beyond music generation. This undermines informed consent and makes it easier for users to approve a token with dangerous permissions they do not expect from the skill's advertised purpose.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code performs silent automatic updates and explicitly states they should never block the requested command, meaning package files may change without user-facing notice during normal operation. Even with checksum validation, this is dangerous because it normalizes unattended code changes in a skill whose purpose does not require self-modification.

Credential Access

High

• Category: Privilege Escalation

Content

},
  "mcp": {
    "authentication": "device-bearer",
    "credential_file": "~/.beatra/credentials.json",
    "name": "beatra",
    "transport": "streamable-http",
    "url": "https://mcp.beatra.ai/mcp"

• Confidence: 90% confidence
• Finding: The manifest explicitly references a local bearer credential file at ~/.beatra/credentials.json for MCP authentication. Hard-coding a credential file path increases the chance that the skill or surrounding tooling will access persistent secrets from disk, expanding the blast radius if the skill is compromised or if users do not understand what credentials are being exposed to the remote MCP endpoint.

Self-Modification

High

• Category: Rogue Agent

Content

)
    update = subparsers.add_parser(
        "update",
        help="Check, install, or configure Beatra package self-updates",
    )
    update.add_argument(
        "--check",

• Confidence: 93% confidence
• Finding: The exposed self-update capability allows the package to replace its own installed files, which is inherently risky for a skill that should only process lyrics and generate song prompts. In the skill context this is more dangerous because it grants a content-focused tool ongoing code evolution and persistence capabilities unrelated to its declared function.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.