T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:58- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Lyria
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended to generate music through Google Vertex AI, but it handles Google access tokens and setup in ways that deserve review before installation.
Review this skill before installing. Use safer official gcloud installation instructions, avoid storing live Google access tokens in plaintext workspace files when possible, restrict any credential file permissions, and confirm the configured region and project before generating music because prompts and billable requests go to Google Vertex AI.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/music-gen.py:44- Finding
Unvalidated Region Value Controls the Destination Receiving a Bearer Token
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The instruction to install software via curl https://sdk.cloud.google.com | bash executes a remote script directly in the shell without giving the user an opportunity to verify its contents or integrity. If the download source, connection, or delivery path is compromised, this becomes arbitrary code execution on the user's machine.
- Content
Linux:
bash curl https://sdk.cloud.google.com | bash exec -l $SHELL
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The explicit use of | bash creates a high-risk command chain where untrusted network content is immediately executed. In a skill context, this is especially dangerous because an agent or user may copy-paste the command reflexively during setup, turning documentation into a code-execution vector.
- Content
Linux:
bash curl https://sdk.cloud.google.com | bash exec -l $SHELL
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill clearly directs reading local files such as ~/.openclaw/workspace/lyria/config.json and making outbound network requests to Google Vertex AI, yet it declares no permissions or allowed-tools scope. That mismatch weakens least-privilege controls and makes it harder for a host system or reviewer to understand what the skill can access before use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill is built around sending user prompts to Google Lyria via Vertex AI, but it does not clearly warn that prompt contents are transmitted to a third-party cloud service. Users may provide sensitive creative plans or proprietary content without realizing it leaves the local environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
When using this skill for the first time on a machine, follow these steps:
Step 1: Create Directory Structure
bash # Create the lyria folder structure in workspace
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 96% confidence
- Finding
This persistence finding is substantiated because the skill stores active credentials in ~/.openclaw/workspace/lyria/config.json, causing secret material to survive across sessions and potentially be exposed to other local tools or accidental sharing. The danger is higher than ordinary persistence because the persisted data is an authentication token, not just non-sensitive settings.
- Content
md ⚠️ **Note:** This token expires in approximately 1 hour. You'll need to refresh it periodically. ### Step 5: Create Config File Create `~/.openclaw/workspace/lyria/config.json` with your values:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs users to place a live bearer token into a local JSON file, creating a recoverable credential on disk that other tools, processes, or future sessions may read. Although the token is short-lived, it still grants API access during its lifetime and the text does not emphasize its sensitivity or recommend safer storage mechanisms.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. **Use specific prompts** — "jazz piano in F minor" works better than "jazz music" 2. **Specify what to exclude** — "no drums" or "no vocals" helps steer output 3. **Generate variations** — Create 2-3 versions and let user pick favorite 4. **Monitor costs** — At $0.06 per 30s, 10 generations = $0.60 5. **Refresh token proactively** — If session >45 min, get fresh token before generating
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python print(f"Sample count: {sample_count}") try: response = requests.post(url, headers=headers, json=data) response.raise_for_status() except requests.exceptions.RequestException as e: print(f"Error calling API: {e}", file=sys.stderr)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code reads a bearer token from configuration and uses it to authenticate a network request to the Google Lyria API. While the script prints the prompt and request status, it does not clearly disclose to the user that their prompt and authentication token will be sent to an external service, and the operation is not fully explained in a safety-oriented warning or confirmation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The line 'English prompts recommended' imposes a language preference in natural language guidance, but does not explain whether other languages are supported or let the user opt in to that constraint. This can conflict with language/locale policy expectations that skills should not force a specific language without user choice or justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The script creates the output directory and writes WAV files to disk, which is a safety-relevant file write operation. Although output paths are printed after writing, there is no prior warning in the usage/help text or function documentation that running the script will create files in the configured output directory.
- Content
Static analysis
No suspicious patterns detected.