Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent music-generation workflow, but it automatically uses an API key to send user lyrics to an external service and has underdisclosed callback and temporary-file behavior.
Review before installing. Only use this skill if you are comfortable with automatic, no-confirmation submission of prompts and lyrics to KIE/Suno using your API key, possible API costs, and local plaintext temp-file handling. A safer version would require confirmation before generation, use a private unique temp file or stdin, remove or disclose the callback URL, and document exactly what data is sent externally.
SKILL.md:62Predictable Shared Temporary File Permits File Replacement and Symlink Attacks
The skill description promises a bounded songwriting workflow, but the detected behavior includes external callback/API task submission and execution characteristics not disclosed in the declared purpose. This mismatch is dangerous because operators and policy systems may approve the skill based on an incomplete description, while it performs materially different external actions.
The instructions write user-derived content to /tmp/suno_clone_lyrics.txt and execute a shell command with that content, yet provide no warning or safety controls. This is dangerous because file write plus shell execution creates a strong pathway for command injection, unsafe handling of untrusted text, and unreviewed outbound actions to external services.
The skill references a sensitive environment credential (KIE_API_KEY) and directs external generation behavior, but it declares no explicit tool scope or permission boundaries. That creates an under-specified trust boundary where an agent may access environment data or invoke code-capable operations without clear least-privilege constraints.
The skill uses broad automation language such as immediately starting multi-step processing and not waiting for user confirmation, without defining clear invocation constraints. In an agent environment, that increases the risk of unintended execution, surprise external actions, and bypass of human review for operations that may incur cost or handle third-party content.
The skill instructs the environment to expose KIE_API_KEY without any guidance on secret minimization, storage, masking, or transmission. In a workflow that also performs external automation, undisclosed credential handling raises the risk of accidental leakage, overbroad secret exposure, or use in unapproved contexts.
The manifest describes an end-user music-generation workflow, but does not mention credential management or any need to access host environment secrets. Reading API keys from process environment introduces a capability beyond the stated creative task and is not explicitly justified by the manifest text.
The manifest says the workflow '最终直接返回试听链接', implying a final user-facing output of the listening link. Instead, the code prints multiple fields for each generated track, including title, audio URL, video URL, duration, and audio ID, and does not specifically structure the result as a direct single listening-link return.
The stated behavior is an uninterrupted end-to-end run that directly returns the result without waiting for user confirmation. Supplying a callback URL adds an additional asynchronous integration behavior that is not described in the manifest and is unnecessary to the polling-based flow implemented elsewhere in the file.
The script submits user-provided title, prompt, and tags to a third-party API without any notice, consent flow, or minimization, which creates a privacy and data-handling risk. In this skill's context, users may provide copyrighted lyrics, stylistic references, or sensitive creative material, making undisclosed external transmission more sensitive than in a purely local tool.
No suspicious patterns detected.