LrshuAI Music Generation

• Outcome: Review
• Latest audit: May 28, 2026 · 4:48 AM UTC
• Version: 1.0.1

Overview

This music-generation skill can send prompts, credentials, and optional local media to a configurable remote service while exposing broader capabilities than it describes.

Review before installing. Only use this if you trust the publisher and the configured TEAM_BASE_URL, use a scoped and revocable TEAM_API_KEY, and avoid passing local image or video files unless you intend to upload them to the remote service. The evidence supports Review rather than malicious: there is no persistence, destruction, or hardcoded exfiltration endpoint, but the scope and disclosure are too broad for a simple music-generation skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

• Confidence: 93% confidence
• Finding: The request target is taken from the TEAM_BASE_URL environment variable and used directly for an authenticated POST request, causing the Bearer token and all prompt/media content to be sent to whatever host the runtime environment specifies. In an agent or plugin environment where environment variables may be influenced by deployment configuration, this becomes a credential and data exfiltration path rather than a harmless configurability feature.

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()

• Confidence: 91% confidence
• Finding: The polling GET request reuses the same environment-derived base URL and Authorization header, so an attacker-controlled TEAM_BASE_URL would continue receiving authenticated traffic during the polling loop. This extends the exfiltration window and may leak task identifiers, status metadata, and credentials repeatedly.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares no explicit permissions while its metadata and instructions indicate use of an environment secret and likely outbound API access. This creates a transparency and governance gap: an agent may invoke code that consumes credentials and network capabilities without the permission model clearly reflecting that behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill is presented as a music-generation tool, but the documented and analyzed behavior suggests a broader multimodal/generic generation pipeline that can read local media, fetch remote media, and transmit content to an external service. That mismatch is dangerous because users and agents may authorize it under a narrow trust assumption while it actually handles arbitrary files and network interactions.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs the agent to directly execute a local Python script, effectively granting command-execution behavior through the skill interface. Even if the intended task is music generation, direct shell/script execution expands the attack surface because the agent is being told to bypass safer skill runners and execute repository code with local interpreter and environment access.

Intent-Code Divergence

Low

• Confidence: 80% confidence
• Finding: Telling the agent to 'directly execute' a Python command is inconsistent with presenting the skill as a normal high-level capability. This can mislead operators about how the skill works and normalize unsafe invocation patterns that bypass standard controls, logging, or policy checks.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The skill claims to be for music generation, but the implementation is a generic model invoker that accepts arbitrary model IDs and supports unrelated multimodal inputs. This capability mismatch increases the attack surface, defeats user expectations, and can be used to route arbitrary content to external models under the guise of a narrowly scoped skill.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Image and video handling are not justified by the stated purpose of generating music from text/style prompts, yet the code can read local files, base64-encode them, and transmit them to a remote API. In this skill context, those extra modalities materially increase the chance of accidental or unauthorized sensitive file disclosure.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The explicit support for image-to-video model families is unrelated to a music-generation skill and shows the script is broader than advertised. In this context, hidden or unnecessary capability is dangerous because it enables off-purpose remote processing of user-supplied media and undermines least privilege.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script transmits prompts and optional image/video content to a remote service without any explicit notice, consent flow, or data-handling warning to the caller. Because this skill can also package local files as data URLs, the absence of clear disclosure is especially risky in an agent setting where users may not realize local content is leaving the environment.

Static analysis

No suspicious patterns detected.