ClawHub
Back to skill

Security audit

Suno

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Suno music-generation helper that stores local preferences and generated-song records, with no hidden execution or exfiltration found.

Install only if you are comfortable with music prompts and lyrics being sent to the selected generation service and with successful prompts/project notes being kept locally under ~/Clawic/data/suno/. Avoid putting secrets or sensitive unpublished material in prompts unless you trust the provider, and periodically review or delete memory.md and project files if they contain private content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Low
Confidence
91% confidence
Finding
The guidance instructs users to persist downloaded audio and to log prompts verbatim in local files, which can retain sensitive user-provided content beyond the immediate generation task. In this skill context, prompts may contain private names, themes, brand references, or unpublished creative material, so indefinite local retention increases privacy and data leakage risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instruction to log successful prompts verbatim lacks any privacy warning or filtering guidance. Because music prompts and lyrics can contain personal data, confidential business material, or copyrighted text supplied by users, verbatim logging creates an avoidable record of sensitive inputs.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The instruction to store a successful prompt string in `~/Clawic/data/suno/memory.md` directs persistence of user-derived content to local storage without any notice, consent flow, retention limit, or sensitivity check. Even though the stored item is 'just a prompt,' prompts can contain personal, confidential, or copyrighted material, so silent retention creates privacy and data-governance risk.

Ssd 3

Medium
Confidence
95% confidence
Finding
Preserving all successful prompts in a persistent memory file encourages natural-language retention of user content without limits or safeguards. This is especially risky here because users may provide original lyrics, personal stories, or sensitive references that would then be stored in a human-readable file vulnerable to later disclosure.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.