ClawHub
Back to skill

Security audit

Doubao Genbgm

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates music through Volcano Engine's API, with expected credential, network, and local output behavior that should be handled carefully.

Install only if you are comfortable sending prompts, lyrics, and related task data to Volcano Engine. Keep VOLC_ACCESS_KEY and VOLC_SECRET_KEY out of repositories and shared logs, prefer a virtual environment, and consider pinning dependencies before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tainted flow: 'audio_url' from os.environ.get (line 423, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/gen_music.py (reported line 301)May include surrounding context.

python
def download_audio(audio_url: str, output_path: str):
    """Download audio file to local path."""
    print(f"\nDownloading audio to: {output_path}")
    resp = requests.get(audio_url, timeout=120, stream=True)
    if resp.status_code != 200:
        print(f"Error: Download failed HTTP {resp.status_code}", file=sys.stderr)
        sys.exit(1)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The authentication setup references editing a .env file and exporting long-lived access credentials, but it provides no guidance on secure secret storage, file protection, or avoiding accidental disclosure in shells, logs, or repositories. This increases the likelihood of credential leakage, which could allow unauthorized API use, billing abuse, or broader account compromise depending on credential scope.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

2. Configure Authentication

bash
# Edit .env and fill in your Volcano Engine AccessKey and SecretKey
export VOLC_ACCESS_KEY=$VOLC_ACCESS_KEY

# 火山引擎 Secret Access Key（必填）

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 14)May include surrounding context.

python
Usage (generate song from lyrics):
  python3 gen_music.py --mode song --lyrics-file my_lyrics.txt --genre "Folk" --gender Female

Authentication: Set VOLC_ACCESS_KEY and VOLC_SECRET_KEY in .env file
Dependencies: pip install requests
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 34)May include surrounding context.

python
Usage (generate song from lyrics):
  python3 gen_music.py --mode song --lyrics-file my_lyrics.txt --genre "Folk" --gender Female

Authentication: Set VOLC_ACCESS_KEY and VOLC_SECRET_KEY in .env file
Dependencies: pip install requests
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 37)May include surrounding context.

python
Usage (generate song from lyrics):
  python3 gen_music.py --mode song --lyrics-file my_lyrics.txt --genre "Folk" --gender Female

Authentication: Set VOLC_ACCESS_KEY and VOLC_SECRET_KEY in .env file
Dependencies: pip install requests
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 379)May include surrounding context.

python
Usage (generate song from lyrics):
  python3 gen_music.py --mode song --lyrics-file my_lyrics.txt --genre "Folk" --gender Female

Authentication: Set VOLC_ACCESS_KEY and VOLC_SECRET_KEY in .env file
Dependencies: pip install requests
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 384)May include surrounding context.

python
Usage (generate song from lyrics):
  python3 gen_music.py --mode song --lyrics-file my_lyrics.txt --genre "Folk" --gender Female

Authentication: Set VOLC_ACCESS_KEY and VOLC_SECRET_KEY in .env file
Dependencies: pip install requests
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 40)May include surrounding context.

python
"""Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables."""
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gen_music.py (reported line 41)May include surrounding context.

python
"""Load environment variables from .env file (script directory first, then parent directory). Does not overwrite existing environment variables."""
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to submit prompts, lyrics, and authenticated requests to a third-party cloud API, but it does not clearly warn that this content leaves the local environment and is processed by an external provider. Users may unknowingly send sensitive creative content or proprietary material off-platform, creating privacy, data handling, and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The parameter reference states that --lang defaults to Chinese, which imposes a specific language choice unless the user overrides it. This is a natural-language policy concern because the skill does not offer an explicit user choice first or explain why a Chinese default is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file documents an authenticated API endpoint using VOLC_ACCESS_KEY and VOLC_SECRET_KEY and later supports CallbackURL, but it does not include any user-facing warning about protecting credentials or that task metadata/results may be sent to an external callback endpoint. Under the markdown-file criteria for SQP-2, privacy- or integrity-affecting behaviors should be disclosed when describing the skill's behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The parameter reference states Lang defaults to Chinese, which imposes a specific language/locale choice by default. The file does list alternative languages later, but it does not frame the default as user-selectable or justify the locale constraint as region-specific.

Content

No source excerpt is available for this finding.