Suno Browser Songmaking

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: Developer: Version: Description: OpenClaw Agent Skill The skill bundle is designed for browser-based song creation with Suno.ai. All instructions in `SKILL.md` and `references/suno-workflow.md` are clearly aligned with this stated purpose, detailing UI interactions and workflow steps. While the skill mentions using 'Chrome relay' to interact with the user's existing browser session, this is presented as a convenience if the user is already logged in, and the instructions strictly limit the agent's actions to the `suno.ai` domain. There is no evidence of data exfiltration, malicious execution, persistence, obfuscation, or prompt injection attempts to deviate from the stated, benign objective.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may create songs and retrieve links using the user's Suno account session.

Why it was flagged

The skill may act through the user's logged-in Suno browser session. This is expected for Suno automation, but users should understand it uses their account context.

Skill content
Prefer Chrome relay if the user is already logged in. Otherwise use the isolated OpenClaw browser and ask for login if needed.
Recommendation

Use an isolated browser when possible, confirm the Suno account being used, and review before generating or sharing outputs.

What this means

The agent can submit prompts and generate new tracks in Suno on the user's behalf.

Why it was flagged

The skill instructs browser actions that create new content in Suno. This is central to the stated purpose, but it is still a user-account mutation that should remain user-directed.

Skill content
Paste lyrics and style tags. Generate and wait for completion.
Recommendation

Confirm the final lyrics, style tags, persona, and title before allowing the agent to click Generate.

NoteMedium Confidence
ASI01: Agent Goal Hijack
What this means

If followed too literally, the agent might make the wrong song rather than the one the user requested.

Why it was flagged

The reference includes a fixed example workflow that could conflict with a user's actual requested persona, title, or style if treated as universally applicable.

Skill content
## Exact runbook (Anchor Protocol run) ... select Kara Codex ... Set Song Title to: `Anchor Protocol`.
Recommendation

Treat the 'Anchor Protocol' steps as an example or prior runbook, and follow the user's current brief unless they explicitly request those values.