ClawHub
Back to skill

Security audit

Producer Music

Security checks for vulnerabilities and agentic risk

Overview

This skill documents a cloud music-generation API workflow; it is not hiding code, but users should know their prompts and audio go to AceDataCloud.

Install only if you are comfortable sending music prompts, lyrics, and any reference audio to AceDataCloud. Do not submit confidential recordings, secrets, personal data, or content you do not have rights to use, and keep ACEDATACLOUD_API_TOKEN out of logs, screenshots, chats, and source control.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly sends prompts, lyrics, and uploaded reference audio to a third-party API but does not warn users that their content leaves the local environment. This can lead to accidental disclosure of sensitive, copyrighted, or private material because users may assume the skill operates locally or does not retain submitted data.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The authentication section shows how to export and use an API token but does not warn against exposing it in logs, screenshots, shell history, or shared transcripts. Missing handling guidance increases the chance of credential leakage and unauthorized API use.

Static analysis

No suspicious patterns detected.