ACE Music - Free Suno Alternative Generate unlimited AI music for free using ACE-Step 1.5. Full songs with vocals, lyrics, any genre, any language. No subscription, no credits, no limits. The open-source Suno alternative, powered by ACE Music's free API.
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears to generate music as described by sending prompts to ACE Music’s API and saving the returned audio, but users should notice the API key and local file-writing requirements.
This skill is reasonable for generating music, but it sends prompts and lyrics to ACE Music’s external API and needs an API key. Store the key carefully, avoid sharing sensitive lyrics or prompts, and save generated MP3 files only to safe locations.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may use the user’s ACE Music API key to make music-generation requests to ACE Music.
The skill requires a provider API key even though the registry metadata declares no required environment variables or primary credential. This is purpose-aligned for API access, but users should understand they are granting account/API access.
API Key is stored in env `ACE_MUSIC_API_KEY` ... Store it: `export ACE_MUSIC_API_KEY=<key>` or add to TOOLS.md
Use a dedicated ACE Music API key if possible, store it securely, and revoke or rotate it if the skill is no longer needed.
Generated audio files can be saved locally, including to paths chosen by the user or agent.
The script writes generated audio to a caller-specified file path. This is expected for a music-generation tool, but it can overwrite files if directed to an existing path.
--output|-o) OUTPUT="$2"; shift 2 ;; ... with open(fname, 'wb') as f: f.write(base64.b64decode(b64))
Choose a safe output filename or directory and review before overwriting existing files.
Installation or first use may fail unless the local environment has the expected tools and API key, and users may not see those requirements in registry metadata.
The metadata does not declare the script’s practical dependencies and credential requirement, while the script uses curl, python3, and ACE_MUSIC_API_KEY. This is an under-declared setup/provenance issue, not evidence of malicious behavior.
Required binaries: none ... Required env vars: none ... Primary credential: none
Before use, confirm curl and python3 are available and verify the ACE Music API key setup from the skill documentation.