Security audit
Security checks for vulnerabilities and agentic risk
This Suno skill is a disclosed music-generation helper that sends prompts to selected music services and stores scoped local preferences, with privacy considerations users should understand.
Install only if you are comfortable sending prompts and lyrics to the selected music service and storing local music preferences, project records, and possibly verbatim successful prompts under ~/Clawic/data/suno/. Do not put secrets, private business ideas, or sensitive personal details in prompts you do not want retained or sent to third-party providers.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export AIMUSICAPI_KEY="your-key-here"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export AIMUSICAPI_KEY="your-key-here"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import time
API_KEY = os.environ.get("AIMUSICAPI_KEY")
BASE = "https://api.aimusicapi.ai/api/v1/sonic"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def poll_task(task_id, timeout=300):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import time
API_KEY = os.environ.get("AIMUSICAPI_KEY")
BASE = "https://api.aimusicapi.ai/api/v1/sonic"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def poll_task(task_id, timeout=300):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import time
API_KEY = os.environ.get("AIMUSICAPI_KEY")
BASE = "https://api.aimusicapi.ai/api/v1/sonic"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def poll_task(task_id, timeout=300):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def generate(prompt, instrumental=False):
"""Generate a song from prompt."""
r = requests.post(f"{BASE}/generate",
headers=HEADERS,
json={
"prompt": prompt,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def generate_custom(lyrics, style_tags, title):
"""Generate with custom lyrics."""
r = requests.post(f"{BASE}/custom_generate",
headers=HEADERS,
json={
"prompt": lyrics,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def generate_lyrics(topic):
"""Generate lyrics from topic."""
r = requests.post(f"{BASE}/lyrics",
headers=HEADERS,
json={"prompt": topic})
r.raise_for_status()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
songs = generate_custom(lyrics, "indie pop, dreamy", "Summer Love")
### cURL
```bash
# Generate
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import time
API_KEY = os.environ.get("EVOLINK_API_KEY")
BASE = "https://api.evolink.ai/v1"
HEADERS = {"Authorization": f"Bearer {API_KEY}"}
def generate_evolink(prompt, model="suno-v4", duration=120):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def generate_evolink(prompt, model="suno-v4", duration=120):
"""Generate with EvoLink API."""
r = requests.post(f"{BASE}/audios/generations",
headers=HEADERS,
json={
"model": model,
The document directs users to persist generated audio and verbatim prompts under a local path outside the immediate generation task, creating unnecessary retention of potentially sensitive user content. In this skill context, prompts may contain private creative ideas, personal themes, names, or copyrighted/style-sensitive material, so persistent storage increases exposure risk if the workstation, logs, or backups are later accessed.
The instruction to log successful prompts verbatim to a memory file can capture and retain sensitive user-provided text without warning. In this skill, prompts may include personal details, business ideas, brand names, or copyrighted/style references, so verbatim logging creates a clear confidentiality risk beyond the immediate task.
Persistent storage of user prompts in a shared or durable memory file increases the chance of later disclosure to other tools, users, backups, or future sessions. Because this is a creative-generation skill, the retained text may include sensitive or proprietary ideas that users do not expect to be preserved indefinitely.
The recommendation to download audio immediately and save it to a local filesystem path omits any notice that the skill may write files onto the user's machine. Even though saving outputs is functionally relevant for a music-generation workflow, silent or undocumented local writes can surprise users and create privacy or disk-usage issues.
This markdown file instructs the agent to perform downloads, which can affect the user's filesystem, but it does not explicitly warn the user that files will be saved locally or advise confirming the destination/intent first. Under the markdown-specific missing-warning rule, behaviours affecting user data or system state should be disclosed.
This file is markdown, so natural-language policy checks apply. The instruction to write lyrics in the target language and explicitly label it in the style field creates a prescriptive language requirement rather than offering the user a choice, and it is not framed as optional user opt-in.
The template instructs the agent to create persistent files under the user's home directory and optionally store downloaded audio, but it does not require any user-facing notice or consent before writing to local storage. While the stored content is mostly preference and project data, silent persistence can surprise users, retain sensitive creative history, and create privacy issues if the environment is shared or monitored.
The skill instructs the agent to persist user-successful prompt strings in a local memory file, creating unnecessary retention of user-derived content outside the immediate task flow. Even if the stored data is 'just prompts,' it may still contain sensitive preferences, copyrighted style requests, or identifying phrasing, and the persistence is not clearly essential to basic music generation.
This markdown file directs the skill to record the resolved method in config.yaml, which is a file write affecting persistent user data. The document does not include any explicit user-facing warning that setup will create or modify files under ~/Clawic/data/suno/.
No suspicious patterns detected.