Qqmusic Control

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The user may need to obtain or create the referenced AutoHotkey script separately, so they should verify its source before running it.

Why it was flagged

The skill instructs use of a helper script path, but the provided manifest contains only SKILL.md and no scripts directory or .ahk file.

Skill content

AutoHotkey64.exe scripts/qqmusic_media_keys.ahk 1

Recommendation

Only run a qqmusic_media_keys.ahk script if it comes from a trusted source and its contents are visible and understandable.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

AutoHotkey scripts can automate local system actions, so the user should understand what script is being run.

Why it was flagged

The skill depends on AutoHotkey command execution, which is expected for media-key automation but should be noticed because it executes local automation scripts.

Skill content

依赖 AutoHotkey v2（路径可按需调整）

Recommendation

Install AutoHotkey only from its official source and review the referenced script before using the commands.