Security audit

acestep

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed music-generation helper that calls an ACE-Step API and saves generated audio locally, with no evidence of hidden or destructive behavior.

Install this if you intend to use ACE-Step for music generation. Before use, verify the configured API URL, avoid sending sensitive lyrics or unreleased material to an untrusted remote endpoint, and be aware that outputs are saved under acestep_output. Store API keys carefully because config.json can contain them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger description is broad enough to match many ordinary music-related requests, which can cause the skill to activate in contexts where the user did not intend to invoke external generation, shell commands, or file-writing behavior. Because this skill can run Bash and write outputs, overbroad routing increases the chance of unnecessary side effects and unintended API use.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The skill documents automatic writes into `acestep_output/` but does not prominently warn that invoking the workflow will create files on disk. This can surprise users, especially in shared or sensitive workspaces, and may result in unwanted local artifacts containing generated audio or metadata.

External Transmission

Medium

Category: Data Exfiltration
Content: local http_code if [ -n "$api_key" ]; then http_code=$(curl -s -w "%{http_code}" --connect-timeout 10 --max-time 660 \ -o "$resp_file" \ -X POST "${api_url}/v1/chat/completions" \ -H "Content-Type: application/json; charset=utf-8" \
Confidence: 86% confidence
Finding: The script sends user-supplied prompts, lyrics, and generation parameters to a configurable remote endpoint via /v1/chat/completions, potentially including sensitive creative content and an API key. Because api_url is configurable and not constrained to trusted hosts, a user or upstream workflow could redirect these requests to an unintended server, increasing data-exfiltration and SSRF-like risk.

External Transmission

Medium

Category: Data Exfiltration
Content: local api_key=$(load_api_key) local response if [ -n "$api_key" ]; then response=$(curl -s -X POST "${api_url}/release_task" \ -H "Content-Type: application/json; charset=utf-8" \ -H "Authorization: Bearer ${api_key}" \ --data-binary "@${temp_payload}")
Confidence: 85% confidence
Finding: This POST to /release_task transmits user prompts and generation settings to whatever server is configured in api_url, optionally with bearer credentials. In the skill context, external transmission is expected, but the lack of host validation means the tool can be repointed to an attacker-controlled endpoint and used to leak input data or credentials.

External Transmission

Medium

Category: Data Exfiltration
Content: local api_key=$(load_api_key) local response if [ -n "$api_key" ]; then response=$(curl -s -X POST "${api_url}/release_task" \ -H "Content-Type: application/json; charset=utf-8" \ -H "Authorization: Bearer ${api_key}" \ --data-binary "@${temp_payload}")
Confidence: 85% confidence
Finding: The random-generation path also POSTs to a configurable remote /release_task endpoint and may include authorization headers. Although sending requests is part of the intended feature set, unrestricted destination control still creates a genuine risk of sending data and credentials to an untrusted service.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: If jq is not installed, the script will attempt to install it automatically. If automatic installation fails: - **Windows**: `choco install jq` or download from https://jqlang.github.io/jq/download/ - **macOS**: `brew install jq` - **Linux**: `sudo apt-get install jq` (Debian/Ubuntu) or `sudo dnf install jq` (Fedora) ### Before First Use
Confidence: 89% confidence
Finding: This duplicate finding points to the same privileged installation guidance. In this skill, the danger is contextual: it is not malicious by itself, but a music-generation skill does not inherently need admin-level system changes during ordinary use, so embedding sudo-based remediation increases unnecessary operational risk.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: If jq is not installed, the script will attempt to install it automatically. If automatic installation fails: - **Windows**: `choco install jq` or download from https://jqlang.github.io/jq/download/ - **macOS**: `brew install jq` - **Linux**: `sudo apt-get install jq` (Debian/Ubuntu) or `sudo dnf install jq` (Fedora) ### Before First Use
Confidence: 89% confidence
Finding: This duplicate finding points to the same privileged installation guidance. In this skill, the danger is contextual: it is not malicious by itself, but a music-generation skill does not inherently need admin-level system changes during ordinary use, so embedding sudo-based remediation increases unnecessary operational risk.

Static analysis

Detected: suspicious.install_untrusted_source, suspicious.potential_exfiltration

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: scripts/config.json:2

Shell script base64-encodes a local file and sends it over the network.

Critical

Code: suspicious.potential_exfiltration
Location: scripts/acestep.sh:562