Lyria

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:30 AM UTC
• Version: 1.0.0

Overview

The skill appears intended to generate music through Google Vertex AI, but it handles Google access tokens and setup in ways that deserve review before installation.

Review this skill before installing. Use safer official gcloud installation instructions, avoid storing live Google access tokens in plaintext workspace files when possible, restrict any credential file permissions, and confirm the configured region and project before generating music because prompts and billable requests go to Google Vertex AI.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:58
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:58` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash curl https://sdk.cloud.google.com | bash ``` ### Technical Analysis The installation instructions download a mutable remote script and pipe it directly into `bash`. The content is executed immediately without being saved for inspection, pinned to a specific version, or validated using a cryptographic checksum or signature. Although the URL is presented as an official Google Cloud SDK source, this pattern makes the code executed by the user dependent on whatever content the remote endpoint returns at installation time. A compromised upstream service, delivery infrastructure, DNS resolution path, or unexpected redirect could therefore turn the installation step into arbitrary code execution. Installing the Google Cloud CLI is related to the Skill's authentication workflow, but immediate execution of unverified network content is not the minimum privilege or safest mechanism necessary to install it. ### Attack Path 1. A user follows the documented Linux installation instructions. 2. `curl` retrieves the current response from `https://sdk.cloud.google.com`. 3. The response is streamed directly into `bash` without integrity verification or review. 4. If the returned content has been compromised or unexpectedly modified, attacker-controlled shell commands execute immediately. 5. Those commands run with the permissions of the user who invoked the installation command and can access that user's files, credentials, environment, and writable configuration locations. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This can expose Google Cloud credentials, OpenClaw workspace data, API tokens, SSH material, and other user-readable files. It may also permit modification of shell profiles, application configurat ...[truncated 262 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pipeline. 2. Prefer Google's signed operating-system package repository or another platform-native, signature-verified installation method. 3. If a standalone installer must be used: - Pin an explicit installer or SDK version. - Download the installer to a local file rather than executing a stream. - Obtain the expected checksum or signature through an authenticated official channel. - Verify the checksum or signature before execution. - Allow the user to inspect the downloaded script. 4. Use secure curl options such as `--fail --show-error --location` so HTTP failures are not silently passed to a shell. 5. Document the permissions and files the installer is expected to modify. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/music-gen.py:44
• Finding: Unvalidated Region Value Controls the Destination Receiving a Bearer Token<![CDATA[ ## Vulnerability Details **File Location**: `scripts/music-gen.py:44-70` **Vulnerability Type**: Credential disclosure through unsafe URL construction **Risk Level**: High ### Vulnerable Code ```python # Build endpoint URL per Vertex AI Lyria docs url = f"https://{location}-aiplatform.googleapis.com/v1/projects/{project_id}/locations/{location}/publishers/google/models/lyria-002:predict" # Headers per API spec headers = { "Authorization": f"Bearer {token}", "Content-Type": "application/json" } # Request body per Lyria API spec data = { "instances": [ { "prompt": prompt } ], "parameters": { "sample_count": sample_count } } print(f"Sending request to Lyria API...") print(f"Prompt: {prompt}") print(f"Sample count: {sample_count}") try: response = requests.post(url, headers=headers, json=data) ``` The affected values are read from the user-supplied configuration without validating the `location` value: ```python location = config.get("location") token = config.get("bearer_token") ``` ### Technical Analysis The script interpolates the unvalidated `location` configuration value into the authority portion of an HTTPS URL. It then attaches a Google Cloud bearer token to the resulting request. Ordinary region values such as `us-central1` produce the intended Google hostname. However, URL delimiters in a malicious configuration value can change how the URL parser identifies user information, the hostname, path, or other URL components. For example, an `@` delimiter can cause text before it to be interpreted as user information while making subsequent attacker-controlled text part of the effective authority. TLS does not prevent this issue when the resulting destination is an attacker-controlled HTTPS host with a valid certificate. The `requests` library would securely connect to the wrong host and send the `Authorization` header to it. Sending a bearer token to the legitimate Vertex AI ...[truncated 1713 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate `location` before constructing the URL: - Prefer an explicit allowlist of regions supported by Lyria. - At minimum, enforce a strict region identifier pattern that rejects URL delimiters, whitespace, slashes, `@`, colons, backslashes, percent-encoded delimiters, and control characters. 2. Construct the URL and then parse it with a standard URL parser. 3. Before attaching the bearer token, verify all of the following: - The scheme is exactly `https`. - No username or password component is present. - The port is absent or exactly `443`. - The normalized hostname exactly matches an expected Vertex AI hostname derived from an allowlisted region. 4. Keep endpoint selection separate from credential-bearing request construction. Do not send an authorization header until destination validation succeeds. 5. Prefer short-lived Application Default Credentials or an official authenticated Google client library rather than manually persisting and forwarding raw bearer tokens. 6. Protect any unavoidable credential file with restrictive permissions such as mode `0600`, and reject files that are writable by untrusted users where practical. 7. Add tests using malicious region values containing `@`, `/`, `\`, `:`, whitespace, percent encoding, and control characters to confirm that requests are rejected before network transmission. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

External Script Fetching

High

• Category: Supply Chain

Content

**Linux:**
```bash
curl https://sdk.cloud.google.com | bash
exec -l $SHELL
```

• Confidence: 99% confidence
• Finding: The instruction to install software via curl https://sdk.cloud.google.com | bash executes a remote script directly in the shell without giving the user an opportunity to verify its contents or integrity. If the download source, connection, or delivery path is compromised, this becomes arbitrary code execution on the user's machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Linux:**
```bash
curl https://sdk.cloud.google.com | bash
exec -l $SHELL
```

• Confidence: 98% confidence
• Finding: The explicit use of | bash creates a high-risk command chain where untrusted network content is immediately executed. In a skill context, this is especially dangerous because an agent or user may copy-paste the command reflexively during setup, turning documentation into a code-execution vector.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly directs reading local files such as ~/.openclaw/workspace/lyria/config.json and making outbound network requests to Google Vertex AI, yet it declares no permissions or allowed-tools scope. That mismatch weakens least-privilege controls and makes it harder for a host system or reviewer to understand what the skill can access before use.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill is built around sending user prompts to Google Lyria via Vertex AI, but it does not clearly warn that prompt contents are transmitted to a third-party cloud service. Users may provide sensitive creative plans or proprietary content without realizing it leaves the local environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

When using this skill for the first time on a machine, follow these steps:

### Step 1: Create Directory Structure

```bash
# Create the lyria folder structure in workspace

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

⚠️ **Note:** This token expires in approximately 1 hour. You'll need to refresh it periodically.

### Step 5: Create Config File

Create `~/.openclaw/workspace/lyria/config.json` with your values:

• Confidence: 96% confidence
• Finding: This persistence finding is substantiated because the skill stores active credentials in ~/.openclaw/workspace/lyria/config.json, causing secret material to survive across sessions and potentially be exposed to other local tools or accidental sharing. The danger is higher than ordinary persistence because the persisted data is an authentication token, not just non-sensitive settings.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to place a live bearer token into a local JSON file, creating a recoverable credential on disk that other tools, processes, or future sessions may read. Although the token is short-lived, it still grants API access during its lifetime and the text does not emphasize its sensitivity or recommend safer storage mechanisms.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Use specific prompts** — "jazz piano in F minor" works better than "jazz music"
2. **Specify what to exclude** — "no drums" or "no vocals" helps steer output
3. **Generate variations** — Create 2-3 versions and let user pick favorite
4. **Monitor costs** — At $0.06 per 30s, 10 generations = $0.60
5. **Refresh token proactively** — If session >45 min, get fresh token before generating

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

print(f"Sample count: {sample_count}")
    
    try:
        response = requests.post(url, headers=headers, json=data)
        response.raise_for_status()
    except requests.exceptions.RequestException as e:
        print(f"Error calling API: {e}", file=sys.stderr)

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This code reads a bearer token from configuration and uses it to authenticate a network request to the Google Lyria API. While the script prints the prompt and request status, it does not clearly disclose to the user that their prompt and authentication token will be sent to an external service, and the operation is not fully explained in a safety-oriented warning or confirmation.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The line 'English prompts recommended' imposes a language preference in natural language guidance, but does not explain whether other languages are supported or let the user opt in to that constraint. This can conflict with language/locale policy expectations that skills should not force a specific language without user choice or justification.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The script creates the output directory and writes WAV files to disk, which is a safety-relevant file write operation. Although output paths are printed after writing, there is no prior warning in the usage/help text or function documentation that running the script will create files in the configured output directory.

Static analysis

No suspicious patterns detected.