music-2.5

• Outcome: Review
• Latest audit: Sep 3, 2026 · 2:19 PM UTC
• Version: 1.0.11

Overview

The skill mostly matches its AI song-generation purpose, but it asks agents to install multiple unpinned remote skills with automatic confirmation before use.

Review the referenced PrunaAI skills before allowing installation, prefer pinned or reviewed versions, and avoid the full-suite install unless you need it. Do not submit secrets, private lyrics, regulated data, or content you cannot share with Replicate/MiniMax.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The skill instructs agents to install and execute `npx skills` packages without pinning an immutable version or digest. This creates a supply-chain risk: a later package update or compromised upstream release could change behavior and cause the agent to fetch or run unreviewed code in a privileged environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

## HTTP (curl)

```bash
curl -s -X POST \
  -H "Authorization: Bearer ${REPLICATE_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The skill instructs sending user-provided lyrics and prompts, along with authenticated API access, to an external third-party service (Replicate/MiniMax). External transmission is expected for this skill's purpose, but it still carries data exposure, privacy, and governance risk if users are not clearly informed and sensitive content is submitted.

External Transmission

Medium

• Category: Data Exfiltration

Content

"audio_format": "mp3"
    }
  }' \
  "https://api.replicate.com/v1/models/minimax/music-2.5/predictions"
```

Poll `urls.get` until `status` is `succeeded`; download `output`.

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This natural-language note steers users toward specific languages and could discourage other language use without an explicit opt-in or clear regional justification. Under the policy rule, language constraints should be optional, user-chosen, or clearly justified.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.