Lyrion Music

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 0.1.0
• Hash: fc3390d058972578142545c316bdb55d2daedcaf480b77faa8400f31c33adac2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw skill 'lyrion-music' is designed to control a Lyrion Music Server (LMS) via its JSON-RPC API. The `SKILL.md` provides clear, benign instructions for using the skill and contains no prompt injection attempts. The core script `scripts/lyrion.sh` uses `curl` to send JSON-RPC requests to a configurable host (defaulting to a private IP `192.168.20.10` or `192.168.20.40`). It does not access sensitive files, exfiltrate data to unauthorized external endpoints, or execute arbitrary remote code. The use of `python3 -m json.tool` is solely for formatting output, which is a benign debugging/readability practice. All observed behaviors are aligned with the stated purpose of controlling a local music server.