Security audit

Music Craft

Security checks across malware telemetry and agentic risk

Overview

Music Craft is a disclosed music-generation workflow that uses expected local and cloud music tools, with consent gates for installs, uploads, and overwrites.

Before installing, be aware that cloud backends may send prompts, lyrics, reference URLs, and generation instructions to providers, while local backends can download large models and write audio/cache files. Use it when you are comfortable approving those steps explicitly and avoid sending private lyrics or proprietary material to a cloud backend unless that is intentional.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Context-Inappropriate Capability

Low

Confidence: 77% confidence
Finding: The skill encourages use of durable memory tools to recall prior user preferences even though persistent memory is not strictly necessary to generate music. That broadens data access beyond the immediate task and can expose unrelated personal preference history or sensitive user context if the agent over-collects or overuses memory.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The documentation instructs the agent to perform a web search for structure analysis of a reference song, introducing network access that is not necessary for many requests and may send user intent or prompts to external services. Even if meant for enrichment, this expands the attack surface and can create privacy, compliance, and prompt-injection risks from untrusted web content.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file gives two incompatible instructions for user-provided lyrics: it first says to keep the user's words unchanged, then later says that for short inputs the system should write new verses around the supplied text. That inconsistency can cause unauthorized modification or supplementation of user content, which is especially risky when the user expects exact preservation of their lyrics or copyrighted text handling.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The README states the skill should load automatically when the task is 'clearly music generation' and then gives broad examples, but it does not define a narrow, machine-verifiable activation boundary. In an agent environment, ambiguous auto-activation can cause the skill to engage on loosely related prompts, increasing the chance of unintended tool use, prompt interference with other skills, or unnecessary transmission of user content to a backend.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document includes concrete shell commands that clone a repository, install dependencies, and run software directly on the user's machine. In an agent skill context, this can cause the agent to suggest or emit system-modifying commands without explicit consent, safety warnings, or environment checks, increasing the risk of unintended code execution and supply-chain exposure.

Natural-Language Policy Violations

Medium

Confidence: 78% confidence
Finding: The guidance instructs the agent to fall back to English when the provider does not support the requested language, without first asking the user. This is a consent and user-intent handling flaw: it can silently change output semantics, produce unwanted content, or mishandle culturally or legally sensitive requests.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: Defaulting generated vocals to English without user opt-in can cause the system to create content the user did not request, especially when the example itself says language is missing and should be clarified. In generative systems, silently filling a culturally or legally meaningful attribute can lead to consent, quality, and policy issues, particularly for multilingual or locale-sensitive users.

Natural-Language Policy Violations

Medium

Confidence: 79% confidence
Finding: The workflow says to auto-detect language and defaults to Spanish in the example flow without making clear that this must reflect explicit user preference. In a content-generation skill, silently fixing language can produce outputs the user did not request and may mishandle sensitive linguistic or cultural intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The Stable Audio example explicitly posts a user prompt and bearer-authenticated request to a third-party API, but the documentation does not warn that prompts may contain sensitive user content and will leave the local environment. In a skill context, users may assume backend examples are interchangeable and privacy-neutral, so omission of a transmission warning can lead to unintended disclosure of lyrics, prompts, or proprietary material.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The worked example hard-codes 'bright female vocal in English' as part of the default prompt for a vague request, which can cause the agent to impose language and gendered vocal attributes the user did not request. In this music-generation context, the risk is primarily unwanted bias and reduced user autonomy rather than direct security compromise, but examples often become de facto defaults in downstream behavior.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instruction to "enrich the request from the image or URL before questioning the user" implies the system may fetch and process external content without explicitly warning or confirming with the user. That creates privacy and security risk because supplied URLs can trigger unexpected outbound requests, expose internal network access patterns, or retrieve malicious/untrusted content for downstream processing.

External Transmission

Medium

Category: Data Exfiltration
Content: **Best for:** short instrumentals, sound design, text-to-audio. ```bash curl -s -X POST https://api.stability.ai/v2alpha/audio/generate \ -H "Authorization: Bearer $STABILITY_API_KEY" \ -F "prompt=<prompt>" \ -F "duration=180" \
Confidence: 88% confidence
Finding: https://api.stability.ai/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.