ClawHub
Back to skill

Security audit

Code to Music

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed code-to-music utility that reads a user-chosen file, sends derived music prompts to MiniMax, and saves the returned audio, with some privacy and download-safety caveats.

Install only if you are comfortable sending code-derived counts, prompts, and generated lyrics to MiniMax. Avoid using it on sensitive proprietary code unless that external sharing is acceptable, and consider adding URL validation and response-size limits before routine use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tainted flow: 'headers' from os.environ.get (line 191, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/code2music.py (reported line 209)May include surrounding context.

python
}
    }
    
    r = requests.post(API_URL, headers=headers, json=payload, timeout=300)
    resp = r.json()
    status = resp.get('base_resp', {}).get('status_code', 'N/A')
    msg = resp.get('base_resp', {}).get('status_msg', 'N/A')

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/code2music.py (reported line 158)May include surrounding context.

python
f"Think: algorithmic music, computational beauty."
    )
    
    return prompt, lyrics

def main():
    if len(sys.argv) < 2:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill clearly describes capabilities that read local code files, access environment variables for an API key, and send data to an external network service, but it declares no explicit tool scope or permissions. This creates an authorization and transparency gap: a user or host system may not understand that local file content and secrets-adjacent configuration are involved, increasing the risk of unintended data exposure or over-broad execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill markets itself as converting code to music but does not warn users that code content or structure-derived information may be transmitted to an external API. In this context, source code may contain proprietary logic, secrets, internal identifiers, or sensitive comments, so omitting this disclosure can cause users to unknowingly exfiltrate sensitive information to a third party.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes a skill that analyzes code features and generates music, but the implementation also depends on reading a secret from the process environment. Accessing environment-stored credentials is a broader capability than simple code analysis/conversion and is not stated in the skill description.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/code2music.py (reported line 13)May include surrounding context.

python
import os

API_KEY = os.environ.get('MINIMAX_API_KEY', '')
API_URL = 'https://api.minimaxi.com/v1/music_generation'

if not API_KEY:
    print('[ERROR] MINIMAX_API_KEY not set')

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This is an external network transmission to a third-party API. In context, that is core functionality rather than covert exfiltration, but it still creates a real data exposure boundary because prompts and generated lyrics derived from local code leave the system.

Content

Scanner excerpt · scripts/code2music.py (reported line 209)May include surrounding context.

python
}
    }
    
    r = requests.post(API_URL, headers=headers, json=payload, timeout=300)
    resp = r.json()
    status = resp.get('base_resp', {}).get('status_code', 'N/A')
    msg = resp.get('base_resp', {}).get('status_msg', 'N/A')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends data derived from a user-supplied code file to an external service, but the script does not clearly warn at runtime that code characteristics and generated lyrics/prompts based on the code are transmitted off-system. In a code-processing tool, this matters because even derived metadata from proprietary code may be sensitive in some environments.

Content

No source excerpt is available for this finding.

Tainted flow: 'audio_url' from requests.post (line 216, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
94% confidence
Finding

The script downloads a URL returned by the remote API without validating the scheme, host, or content type. If the upstream service is compromised or behaves unexpectedly, this creates an SSRF-style/untrusted fetch risk and could retrieve malicious or oversized content to the local environment.

Content

Scanner excerpt · scripts/code2music.py (reported line 218)May include surrounding context.

python
if resp.get('data', {}).get('audio'):
        audio_url = resp['data']['audio']
        print(f'[DOWNLOADING] {audio_url}')
        ar = requests.get(audio_url, timeout=60)
        with open(output_file, 'wb') as f:
            f.write(ar.content)
        size_kb = len(ar.content) // 1024

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The line says "歌词固定为英文", which imposes a specific language by default and does not present it as an opt-in or document a justified locale-specific constraint. This matches the policy category for natural-language language/locale restrictions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.