T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:157- Finding
Server-Side Request Forgery Through Unvalidated API and Audio URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
music generate
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent music-generation helper, but its automated path asks users to rely on unofficial services with account session credentials and includes under-scoped network downloads and file writes.
Use the manual Suno/Udio web workflow unless you have reviewed and isolated the third-party wrapper. Do not give a primary account session to an untrusted wrapper, and only run the automated snippet in a sandbox with restricted network access and a dedicated output directory where overwriting track files is acceptable.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:172- Finding
User-Controlled Output Directory Permits File Overwrite and Symlink Attacks
- Content
View full analysis
/track_1.mp3`. 4. `open(filepath, "wb")` follows any symbolic link and truncates the resolved target. 5. Attacker-selected remote bytes are written over the target file. ### Impact Assessment The process can overwrite any file writable by the agent's operating-system ac ...[truncated 425 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:174- Finding
Unbounded and Unvalidated Remote Download Enables Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:131- Finding
Unpinned Community API Wrappers Are Recommended for Use With Account Session Credentials
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The skill advises use of account session credentials stored in a local .env for unofficial wrappers. Session credentials are highly sensitive and often grant full account access; encouraging their use with third-party wrappers materially increases the chance of credential compromise or unauthorized account activity.
- Content
These require your account session credentials. Store credentials in a local .env file — never hardcode them in scripts. Refer to each project's README for setup instructions.
text
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill is described as a prompt-composition assistant, but it also includes code and guidance to call a local API wrapper and download remote audio files. This expands the trust boundary from harmless text generation into network actions and file writes, which users may not expect from the description alone.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The listed triggers include generic phrases such as "create a song" and activation on any user who "describes a mood, scene, or use case," which is broad enough to overlap with normal conversational requests not necessarily intended to invoke this specific skill. The section does not provide exclusion conditions or tighter scope constraints to distinguish when the skill should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions state that each variant must include "A complete English prompt ready for Suno or Udio," which imposes a language requirement in natural-language guidance. Because the skill elsewhere collects lyric language preferences, forcing English prompt output without opt-in or documented justification is a language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill directs users to community-maintained wrappers that require account session credentials, even though the core function is composing prompts. This encourages use of unofficial infrastructure with sensitive credentials, increasing risk of account takeover, credential theft, or unsafe handling of authenticated sessions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The code sends user-provided prompts to an external/local API service and then retrieves audio from URLs returned by that service. This creates data exfiltration and supply-chain risk: prompts leave the local context, and unvalidated returned URLs can cause unexpected outbound requests and untrusted content downloads.
- Content
md if not api_url: raise EnvironmentError("SUNO_API_URL is not set in environment variables.") response = requests.post(f"{api_url}/api/generate", json={ "prompt": prompt, "make_instrumental": True, "wait_audio": True
Static analysis
No suspicious patterns detected.