Skywork Music Maker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:53 AM UTC
• Version: 1.0.4

Overview

This is a disclosed Mureka music-generation skill, but it needs review because it supports third-party vocal-cloning uploads without a clear consent safeguard and documents an API-key handling pattern that can expose the key locally.

Review this skill carefully before installing if you plan to use vocal cloning. Upload only voice samples and reference audio that you own or have documented permission to use, and assume lyrics, prompts, and uploaded audio are sent to Mureka. Avoid the documented curl billing command on shared or monitored machines; prefer a client that reads MUREKA_API_KEY inside the process, and consider pinning dependencies for reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:286

Finding

API Key Exposed Through Command-Line Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:286 and README.md:232
Vulnerability Type: Credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

SKILL.md:286:

bash

curl -H "Authorization: Bearer $MUREKA_API_KEY" https://api.mureka.ai/v1/account/billing

The same command is duplicated at README.md:232.

Technical Analysis

The shell expands MUREKA_API_KEY before starting curl. The resulting bearer token is therefore supplied as part of the process argument vector. Depending on operating-system policy and local monitoring configuration, command-line arguments can be observed through process-inspection utilities, process accounting, audit systems, diagnostic tooling, or telemetry agents.

Although transmitting the API key to the fixed Mureka HTTPS endpoint is required for authenticated API access, exposing the expanded credential in process arguments is not required. The Python client avoids this particular issue by reading the key from the environment and constructing the header inside the process.

Attack Path

1. An authenticated local attacker, monitoring service, or other process with sufficient process-inspection privileges watches newly created process arguments.
2. The user follows the documented billing-check command.
3. The shell expands $MUREKA_API_KEY into the curl argument containing the authorization header.
4. The observer captures the bearer token while the process is running or from process-accounting records.
5. The captured token is replayed against the Mureka API.

Impact Assessment

A successful attacker obtains the privileges associated with the compromised Mureka API key. This may permit unauthorized music-generation requests, file uploads, access to account-scoped API resources, consumption of paid credits, and resulting account charges. The exact scope depends on the permissions implemented by the Mureka account and API.

...[truncated 196 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the documented command that expands the API key directly into a command-line argument.
• Add a billing-status operation to scripts/mureka.py so the credential is read from MUREKA_API_KEY and the authorization header is constructed inside the Python process.
• If curl must be supported, provide the authorization header through a permission-restricted configuration or standard-input mechanism that does not expose the token in the argument vector.
• Ensure temporary credential-bearing files, if used, are created with owner-only permissions and deleted immediately after use.
• Recommend rotating the API key if it has previously been used in environments with untrusted local users, process accounting, or command-line telemetry.
• Apply the corrected guidance consistently to both SKILL.md and README.md.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10

Finding

Unpinned Third-Party Dependency Allows Non-Reproducible Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10-12
Vulnerability Type: Unconstrained third-party dependency
Risk Level: Low

Vulnerable Code

yaml

install:
  - kind: uv
    package: requests

Technical Analysis

The Skill installs requests without a version constraint, lockfile, or integrity hash. Each installation may therefore resolve to a different package release. This makes the environment non-reproducible and prevents the publisher from ensuring that users install the same dependency version that was reviewed and tested.

requests is a legitimate and necessary dependency for this Skill's declared API functionality; there is no evidence that the current package is malicious or that dependency confusion is presently occurring. The risk arises because an unconstrained future release, compromised distribution artifact, or incompatible transitive dependency could be installed without an additional Skill review.

Attack Path

1. A user or agent installs the Skill dependencies at a later time.
2. The package resolver fetches the latest version satisfying the unconstrained package name.
3. The resolved package or one of its transitive dependencies has been compromised, maliciously replaced, or contains an exploitable regression.
4. The affected dependency is imported by scripts/mureka.py.
5. Malicious or vulnerable dependency code executes with the same filesystem, environment, and network privileges as the Skill process.

Impact Assessment

Successful supply-chain compromise could expose MUREKA_API_KEY, alter API requests, access files readable by the Skill process, tamper with generated output, or perform arbitrary actions available to the Python process. The potential impact is therefore broad, but likelihood is reduced because the declared package is the correctly named, established requests project and no active compromise was identified during this audit.

Remediation

View remediation

Remediation Suggestions

• Pin requests to a reviewed version or narrowly bounded compatible version range.
• Add a generated lockfile that pins all transitive dependencies.
• Use package hashes and require hash verification during installation where supported.
• Regularly update the lockfile through a controlled dependency-review process.
• Run dependency vulnerability and provenance checks in CI before publishing a new Skill version.
• Document the tested Python and dependency versions so installations remain reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Tainted flow: 'key' from os.getenv (line 21, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mureka.py (reported line 51)May include surrounding context.

python

key = api_key or get_api_key()
    url = f"{API_BASE}/v1/files/upload"
    with open(file_path, "rb") as f:
        resp = requests.post(
            url,
            headers={"Authorization": f"Bearer {key}"},
            files={"file": f},

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# Skywork Music Maker 1.0.0

AI-powered music generation skill for Claude Code and other AI agent frameworks. Create professional songs, instrumentals, and lyrics using Mureka AI API with natural language descriptions in any language.

## Quick Links

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 18)May include surrounding context.

Option 1: Use directly from this repo

Reference as: @skywork-music-maker-1.0.0

Option 2: Install to ~/.claude/skills

cp -r skywork-music-maker-1.0.0 ~/.claude/skills/

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README promotes vocal cloning by uploading voice samples but provides no warning about consent, rights of publicity, impersonation risk, or privacy implications. In an agent skill context, this can normalize collecting and transmitting biometric voice data to a third-party service without ensuring the speaker authorized that use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 232)May include surrounding context.

md

- **Issues & Feedback**: [github.com/anthropics/claude-code/issues](https://github.com/anthropics/claude-code/issues)
- **Mureka API Docs**: [platform.mureka.ai](https://platform.mureka.ai)
- **Get API Key**: [platform.mureka.ai](https://platform.mureka.ai) → Register → API Keys → Generate
- **Check Balance**: `curl -H "Authorization: Bearer $MUREKA_API_KEY" https://api.mureka.ai/v1/account/billing`

## Examples

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md

- **Issues & Feedback**: [github.com/anthropics/claude-code/issues](https://github.com/anthropics/claude-code/issues)
- **Mureka API Docs**: [platform.mureka.ai](https://platform.mureka.ai)
- **Get API Key**: [platform.mureka.ai](https://platform.mureka.ai) → Register → API Keys → Generate
- **Check Balance**: `curl -H "Authorization: Bearer $MUREKA_API_KEY" https://api.mureka.ai/v1/account/billing`

## Examples

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities that access environment secrets, write files, and make network requests, but it does not explicitly constrain tool permissions or allowed tools. In an agent environment, this increases the risk of overbroad execution, including unintended use of the API key, arbitrary local file writes, or outbound requests beyond what users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation wording is broad enough to match ordinary user requests about making music, which can cause the skill to auto-activate outside a clearly bounded context. Ambiguous activation increases the chance that the agent sends user prompts, lyrics, or local audio files to the external API without sufficiently explicit user intent for this specific skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Accepting essentially any natural-language music description in any language makes activation scope very broad and difficult to distinguish from normal conversation. In a skill that transmits prompts, lyrics, and uploaded audio externally, that ambiguity materially raises privacy and consent risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mureka.py (reported line 35)May include surrounding context.

python

def post_json(path, payload, api_key=None, timeout=60):
    url = f"{API_BASE}{path}"
    resp = requests.post(url, json=payload, headers=headers(api_key), timeout=timeout)
    resp.raise_for_status()
    return resp.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The song command sends user-provided lyrics and optional prompts to a third-party API, but the CLI does not clearly warn that this content leaves the local machine. Users may unintentionally transmit sensitive or proprietary text, which is especially relevant because creative drafts and unpublished lyrics can be confidential.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The lyrics generate/extend features transmit user text to a remote service without making that data flow explicit. This can cause accidental disclosure of private text, copyrighted material, or confidential drafts when users assume processing is local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The upload command transfers local audio files to an external API without a strong privacy warning. Audio content may include biometric voice data, copyrighted material, or unpublished recordings, so silent transmission can materially affect user privacy and compliance obligations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Lines L106-L109 present a 'Traditional Chinese' example where the prompt is framed specifically as 'Chinese traditional guofeng' with Chinese instruments and imagery, but the document does not indicate that language/locale-specific outputs are optional or user-selected. This can be read as prescribing a locale-specific style without opt-in, which falls under natural-language locale policy concerns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.