Security audit

ACE Music - Free Suno Alternative Generate unlimited AI music for free using ACE-Step 1.5. Full songs with vocals, lyrics, any genre, any language. No subscription, no credits, no limits. The open-source Suno alternative, powered by ACE Music's free API.

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its generation script has a real filename-based code execution flaw and weak credential handling guidance.

Review before installing. Use this only with non-sensitive prompts or lyrics, keep the API key in a proper secret store rather than TOOLS.md or chat history, do not set ACE_MUSIC_BASE_URL unless you fully trust the endpoint, and avoid user-supplied or unusual output filenames until the script is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.sh:120
Finding: Arbitrary Python Code Execution Through the Output Filename
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate.sh:7
Finding: API Key Disclosure and Server-Side Request Abuse Through an Unrestricted Base URL
Content: View full analysis
``` The override also accepts plaintext HTTP and local or private-network destinations. This creates two related risks: - Credential and prompt disclosure to an arbitrary server. - HTTP request abuse against services reachable from the machine running the Skill. A configurable endpoint can be useful for controlled development or testing, but unrestricted production credential forwarding exceeds the minimum network privileges needed for the declared functionality. Normal music generation only requires access to `https://api.acemusic.ai`. ### Attack Path 1. A user or automation environment stores a valid `ACE_MUSIC_API_KEY`. 2. An attacker modifies the process environment, wrapper configuration, task definition, or invocation so that `ACE_MUSIC_BASE_URL` points to a server they control. 3. The user invokes the generation script normally. 4. `curl` sends the bearer token, prompt, lyrics, and generation configuration to the attacker-selected ...[truncated 1399 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/generate.sh (reported line 91)May include surrounding context.
sh
echo " Language: $LANGUAGE" >&2 # API call RESPONSE=$(curl -s -X POST "${BASE_URL}/v1/chat/completions" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill invokes shell scripts (scripts/generate.sh) but does not declare any tool scope or allowed-tools boundary. In agent environments, undeclared shell capability increases the chance of unintended command execution or overly broad tool access, especially if the skill is auto-selected for common requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description uses very broad activation language like 'create, generate, or compose music, songs, beats, instrumentals, or audio tracks,' which can cause the skill to trigger on many ordinary music-related prompts. Overbroad routing is dangerous because it may invoke shell-backed behavior and external API workflows when the user only wanted advice, lyrics, or discussion rather than tool execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The setup instructions tell the agent to have the user paste an API key and store it in an environment variable or TOOLS.md without warning that this is sensitive credential material. This creates a realistic risk of credential exposure through logs, shared files, repo commits, or future tool reads, especially because TOOLS.md is often not a secure secret store.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The script sends user-provided prompts, lyrics, and generation parameters to an external third-party API endpoint along with an API key. This is an intentional network behavior for the skill, but it still creates a real data-exposure boundary because potentially sensitive user content is transmitted off-host and the destination can be changed via the ACE_MUSIC_BASE_URL environment variable.
Content: Scanner excerpt · scripts/generate.sh (reported line 91)May include surrounding context.
sh
echo " Language: $LANGUAGE" >&2 # API call RESPONSE=$(curl -s -X POST "${BASE_URL}/v1/chat/completions" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d "$BODY")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The API reference specifies vocal_language defaulting to "en", which imposes a language choice by default. This can violate language/locale policy expectations when users are not explicitly offered a choice or informed of the default behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.