Music Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:45 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent AI music generation guide, with ordinary but real privacy and supply-chain cautions around third-party services and install commands.

Install and run this only if you are comfortable sending music prompts, lyrics, uploaded audio, and related metadata to the selected provider. Use throwaway or scoped API keys, avoid confidential or unreleased material unless the provider terms allow it, and run unpinned package installs or cloned repositories inside an isolated virtual environment or container after reviewing versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: musicgen.md:21

Finding

Unpinned AudioCraft Package Installation

Content

View full analysis

Vulnerability Details

File Location: musicgen.md, line 21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install audiocraft

Technical Analysis

The installation command retrieves the latest dependency version resolved by the Python package index without specifying a reviewed version, package hash, lockfile, or trusted artifact source. Python package installation may execute package build hooks and install transitive dependencies.

No currently malicious version of audiocraft was established during this audit. The vulnerability is the mutable and insufficiently verified dependency resolution process: a compromised upstream release, maintainer account, package index, or transitive dependency could alter the code installed after the Skill has been reviewed.

Attack Path

1. An attacker compromises the upstream package, its publishing account, or one of its unpinned transitive dependencies.
2. The attacker publishes a malicious version that remains compatible with the package name.
3. A user follows the Skill instructions and runs pip install audiocraft.
4. pip resolves and downloads the attacker-controlled release.
5. Malicious installation hooks or imported runtime code execute with the permissions of the user running the command.

Impact Assessment

Successful exploitation could execute arbitrary code under the invoking user's account. This may permit access to files, environment variables, API credentials, network resources, and other data available to that account. It does not inherently grant administrator privileges unless installation is run with elevated permissions or the local environment provides another escalation path.

Remediation

View remediation

Remediation Suggestions

• Pin audiocraft to a reviewed, known-good version.
• Use a requirements or lock file containing hashes for the package and all transitive dependencies.
• Install only from the official package index or another explicitly trusted repository.
• Review package metadata and release provenance before updating.
• Perform installation inside a dedicated virtual environment or container.
• Do not run package installation as root or with sudo.
• Add a documented update process that reviews security changes before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: stable-audio.md:37

Finding

Unpinned Stable Audio Tools Package Installation

Content

View full analysis

Vulnerability Details

File Location: stable-audio.md, line 37
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install stable-audio-tools

Technical Analysis

This command installs a mutable package version and its resolved transitive dependencies without version constraints, artifact hashes, or a lockfile. Package installation can invoke Python build backends and other installation-time code with the user's permissions.

The audit did not establish that the current package is malicious. The risk arises because the effective code fetched by this instruction can change independently of the reviewed Skill documentation.

Attack Path

1. An attacker compromises the package publisher, package repository, or an unpinned transitive dependency.
2. A malicious release is published under a dependency name resolved by the command.
3. A user executes pip install stable-audio-tools.
4. The package manager retrieves and processes the malicious artifact.
5. Installation-time or subsequently imported malicious code executes under the invoking user's identity.

Impact Assessment

Exploitation could result in arbitrary code execution with the invoking user's privileges, including access to readable local files, environment variables, model caches, API tokens, and reachable network services. Administrator-level impact would require the user to run the command with elevated privileges or an independent privilege-escalation condition.

Remediation

View remediation

Remediation Suggestions

• Replace the command with a reviewed, exact package version.
• Supply a hash-locked requirements file covering direct and transitive dependencies.
• Verify package provenance and obtain artifacts only from an official trusted source.
• Use an isolated virtual environment or container with no unnecessary secrets mounted.
• Avoid privileged installation.
• Pin downloaded model revisions and verify model artifact hashes where the model provider supports them.
• Require security review before dependency or model revision updates.

T08 · Insecure Dependencies

Warning

• Location: replicate.md:8

Finding

Unpinned Replicate SDK Installation

Content

View full analysis

Vulnerability Details

File Location: replicate.md, lines 8-11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

pip install replicate
export REPLICATE_API_TOKEN="r8_xxx"

Technical Analysis

The Replicate SDK is installed without a pinned version, artifact hash, or locked transitive dependency set. The adjacent setup instruction places an API token in the process environment. Environment-variable authentication is conventional, and the shown token is a placeholder rather than a hardcoded live secret. However, a compromised package installed by the preceding command could read that environment variable when imported or executed.

No malicious Replicate package was identified. The confirmed weakness is that mutable third-party code is installed immediately before sensitive authentication material is configured for its use.

Attack Path

1. An attacker compromises the replicate package publisher, distribution infrastructure, or one of its unresolved transitive dependencies.
2. The attacker publishes a malicious package release.
3. A user follows the documentation and installs the package without a version or hash constraint.
4. The user exports a valid REPLICATE_API_TOKEN.
5. Malicious installation or runtime code executes and can read the token from the process environment.
6. The attacker may use an exposed token subject to the permissions and billing limits assigned to that token.

Impact Assessment

General exploitation could execute arbitrary code with the user's local permissions. Because the workflow configures a Replicate API token, compromise may additionally expose that token, allowing unauthorized API requests, access to resources visible to the token, or consumption of the associated account's billing quota. The exact cloud impact is limited by the token's provider-side permissions.

Remediation

View remediation

Remediation Suggestions

• Pin the Replicate SDK and all transitive dependencies to reviewed versions.
• Require hashes through a lockfile or hash-checked requirements file.
• Install the SDK in an isolated environment before introducing API credentials.
• Retrieve the token from an approved secret manager at runtime instead of placing it in shell initialization files or command history.
• Use a narrowly scoped token with spending limits where supported.
• Prevent dependency installation processes from receiving production credentials.
• Rotate the token immediately if package compromise or unintended disclosure is suspected.

T08 · Insecure Dependencies

Warning

• Location: riffusion.md:27

Finding

Mutable Riffusion Repository and Unverified Requirements Installation

Content

View full analysis

Vulnerability Details

File Location: riffusion.md, lines 27-29
Vulnerability Type: Mutable source retrieval followed by unpinned dependency installation
Risk Level: Medium

Vulnerable Code:

bash

git clone https://github.com/riffusion/riffusion.git
cd riffusion
pip install -r requirements.txt

Technical Analysis

The instructions clone the repository's current default branch rather than a reviewed commit or signed release. They then install the remotely supplied requirements file without requiring hashes or verifying its contents. Consequently, both the repository content and dependency set can change after the Skill audit.

Although the cloned project is not explicitly executed in these three lines, package installation may execute build hooks from dependencies. Later use of the cloned Python modules also executes repository-controlled code. The audit found no evidence that the referenced repository is currently malicious; the issue is the lack of immutable revision and artifact verification.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by its requirements file.
2. The attacker changes the default branch or dependency declarations to include malicious code.
3. A user clones the mutable default branch according to the Skill instructions.
4. The user installs the attacker-controlled requirements.
5. Malicious build hooks may execute during installation, or malicious repository code executes when the documented Riffusion modules are imported.
6. The payload runs with the permissions of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the user's account. The attacker could access readable project files, user data, environment variables, cached credentials, and network resources, and could modify files writable by that account. The instructions do not themsel ...[truncated 143 chars]

Remediation

View remediation

Remediation Suggestions

• Check out a specific reviewed commit hash or verified signed release rather than the default branch.
• Confirm the repository URL and verify release signatures or commit provenance.
• Audit and lock every dependency from requirements.txt.
• Require hashes for downloaded Python artifacts.
• Install and run the project in a dedicated virtual environment, container, or sandbox with minimal filesystem and network access.
• Keep production credentials out of the installation environment.
• Document a controlled review process for updating the pinned repository revision or dependency lockfile.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (34)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill directs users toward multiple third-party music-generation providers without warning that prompts, lyrics, voice samples, or uploaded media may be sent to external services and retained under provider policies. In a music workflow, users may share unreleased songs, personally identifiable information, or proprietary creative assets, so the omission can lead to unintended data disclosure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This duplicated finding captures the same authenticated external transmission: a POST to Mubert with a bearer token and prompt payload. The danger is the same trust-boundary issue—users may unknowingly disclose credentials and prompt content to a third-party service.

Content

Scanner excerpt · mubert.md (reported line 36)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.mubert.com/v2/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This duplicated finding captures the same authenticated external transmission: a POST to Mubert with a bearer token and prompt payload. The danger is the same trust-boundary issue—users may unknowingly disclose credentials and prompt content to a third-party service.

Content

Scanner excerpt · mubert.md (reported line 36)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.mubert.com/v2/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The hardcoded external API URL itself is not dangerous, but in context it identifies a live third-party endpoint used for prompt submission and authenticated generation. Combined with the surrounding example, it reinforces that user data and tokens leave the local environment without an explicit warning in the documentation.

Content

Scanner excerpt · mubert.md (reported line 37)May include surrounding context.

md

import requests

response = requests.post(
    "https://api.mubert.com/v2/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "prompt": "energetic workout music",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This duplicated finding reflects the text-to-music request that transmits both prompt data and authentication to Mubert. Without warning language, users may expose sensitive content or operational credentials to a vendor they did not realize would process the request.

Content

Scanner excerpt · mubert.md (reported line 53)May include surrounding context.

python

# Using Mubert's text-to-music
response = requests.post(
    "https://api.mubert.com/v2/ttm",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This duplicated finding reflects the text-to-music request that transmits both prompt data and authentication to Mubert. Without warning language, users may expose sensitive content or operational credentials to a vendor they did not realize would process the request.

Content

Scanner excerpt · mubert.md (reported line 53)May include surrounding context.

python

# Using Mubert's text-to-music
response = requests.post(
    "https://api.mubert.com/v2/ttm",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This endpoint reference is part of the text-to-music example that sends user prompts to an external provider. The security issue is not the URL alone, but the undocumented transfer of potentially sensitive prompt content and credentials across a trust boundary.

Content

Scanner excerpt · mubert.md (reported line 54)May include surrounding context.

python

# Using Mubert's text-to-music
response = requests.post(
    "https://api.mubert.com/v2/ttm",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "prompt": "relaxing ambient music for meditation",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 67)May include surrounding context.

Tag-Based Generation

python

response = requests.post(
    "https://api.mubert.com/v2/generate",
    json={
        "tags": ["electronic", "upbeat", "happy"],

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 68)May include surrounding context.

python

response = requests.post(
    "https://api.mubert.com/v2/generate",
    json={
        "tags": ["electronic", "upbeat", "happy"],
        "bpm": 120,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 98)May include surrounding context.

python

response = requests.post(
    "https://api.mubert.com/v2/generate",
    json={
        "tags": ["electronic", "upbeat", "happy"],
        "bpm": 120,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 97)May include surrounding context.

python

# Initialize stream
stream = requests.post(
    "https://api.mubert.com/v2/stream/start",
    json={"tags": ["lo-fi", "chill"]}
)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Replicate API example sends prompts and generation parameters to a third-party remote service, but the skill does not clearly warn users that their input leaves the local environment. In this context, users may assume the skill is local-first because most of the document focuses on local MusicGen usage, so the undisclosed off-device transmission creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file includes a webhook configuration that transmits prediction status and associated request context to a user-specified external endpoint, but it does not warn that prompts or related metadata may leave the local environment. For markdown files, user-affecting network behavior should be accompanied by a disclosure when it could affect privacy or system integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · soundraw.md (reported line 37)May include surrounding context.

md

import requests

# Example API call (actual endpoints may vary)
response = requests.post(
    "https://api.soundraw.io/v1/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · soundraw.md (reported line 38)May include surrounding context.

md

# Example API call (actual endpoints may vary)
response = requests.post(
    "https://api.soundraw.io/v1/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "genre": "corporate",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 67)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mubert.md (reported line 97)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · soundraw.md (reported line 37)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · stable-audio.md (reported line 17)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · suno.md (reported line 34)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · suno.md (reported line 47)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · stable-audio.md (reported line 17)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · stable-audio.md (reported line 18)May include surrounding context.

md

import requests

response = requests.post(
    "https://api.stability.ai/v1/generation/stable-audio",
    headers={
        "Authorization": f"Bearer {STABILITY_API_KEY}",
        "Content-Type": "application/json"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · suno.md (reported line 34)May include surrounding context.

python

import requests

response = requests.post(
    "https://api.sunoapi.org/v1/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · suno.md (reported line 35)May include surrounding context.

md

import requests

response = requests.post(
    "https://api.sunoapi.org/v1/generate",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "prompt": "upbeat pop song about summer",

Static analysis

No suspicious patterns detected.