Giggle Generation Music

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:18 PM UTC
• Version:
  0.0.10

Overview

This is a coherent Giggle.pro music-generation skill that uses a Giggle API key and sends prompts or lyrics to Giggle as expected, with privacy caveats users should understand.

Install only if you are comfortable using your GIGGLE_API_KEY for generation tasks and sharing prompts, lyrics, song titles, and style notes with Giggle.pro. Avoid submitting confidential or copyrighted material unless you have permission, keep generated signed audio links private, and verify the publisher/source because one localized file still names a different repository.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases are broad enough to match many ordinary music-related requests, which can cause unintended invocation of a networked skill that uses an API key and submits user content to a third-party service. Over-broad routing increases the chance of accidental data disclosure or surprising external actions when the user may have only wanted general advice, lyrics help, or discussion.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases include ambiguous, high-frequency terms like “写歌”, “AI 音乐”, and “背景音乐” that may appear in many benign contexts, making accidental activation likely. In this skill, accidental activation is more concerning because execution submits user prompts or lyrics to a third-party API, so misfires have privacy and integrity consequences beyond mere UX issues.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases include ambiguous, high-frequency terms like “写歌”, “AI 音乐”, and “背景音乐” that may appear in many benign contexts, making accidental activation likely. In this skill, accidental activation is more concerning because execution submits user prompts or lyrics to a third-party API, so misfires have privacy and integrity consequences beyond mere UX issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to send user descriptions or full lyrics to giggle.pro but does not require informing the user that their content will be transmitted to a third-party service. Because lyrics and prompts may contain sensitive personal, proprietary, or copyrighted material, the lack of disclosure and consent creates a meaningful privacy and data-handling risk.

VirusTotal

61/61 vendors flagged this skill as clean.