Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for generating music through Replicate, but it repeatedly recommends unpinned remote skill installs that can change over time.
Before installing, review and preferably pin any referenced `npx skills add` commands to trusted versions. Avoid sending private, unreleased, or sensitive lyrics/prompts to Replicate/MiniMax unless you accept that third-party processing, and keep `REPLICATE_API_TOKEN` out of shared logs and transcripts.
The skill instructs users to run npx skills add ... without pinning an exact version or immutable digest. That creates a supply-chain risk because future package updates or a compromised registry/package publisher could change what gets executed on the user's machine.
This installation command uses an unpinned package reference, so the actual code fetched by npx may change over time. An attacker who compromises the upstream package or publishing account could deliver malicious code during installation.
The skill references npx skills without a pinned version, exposing users to remote code execution via upstream package drift or takeover. Because npx downloads and executes code, this is a real supply-chain exposure rather than a purely informational issue.
The full-suite installation command is also unpinned, which broadens the blast radius because it may pull a larger set of changing code. If the upstream package becomes malicious, users could install multiple compromised components at once.
This alternative-skill install command also uses a floating npx reference. Even though it appears in a 'When NOT to use' section, it still instructs users to execute mutable remote code and therefore remains a supply-chain risk.
The command recommends executing an unpinned package install via npx, allowing silent changes in fetched code over time. In agent ecosystems, this is especially risky because users may trust skill documentation and execute commands without further review.
The skill explicitly instructs users to send lyrics and prompt content, along with an authorization token, to an external third-party API. External transmission is expected for this skill's function, but it remains security-relevant because potentially sensitive user content leaves the local environment and the token is used in a shell example that users may copy directly.
curl -s -X POST \
-H "Authorization: Bearer ${REPLICATE_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
The documented workflow sends user-provided audio-generation inputs to api.replicate.com, a third-party service, which creates a genuine confidentiality and data-governance exposure. In context this is part of the intended feature, so it is less suspicious than covert exfiltration, but it still matters because users may provide copyrighted, private, or unreleased material.
"audio_format": "mp3"
}
}'
"https://api.replicate.com/v1/models/minimax/music-2.5/predictions"
Poll `urls.get` until `status` is `succeeded`; download `output`.
The follow-on skill installation command is unpinned and can fetch arbitrary future code from upstream. Because it is embedded as a recommended next step, it meaningfully increases the chance that users will execute it in a trusted context.
This npx skills add example lacks version pinning, which makes the install non-reproducible and vulnerable to upstream compromise. Users following the documentation could unknowingly run altered code later than when the skill was authored.
The skill advertises another unpinned install command, preserving the same supply-chain execution risk as the other npx examples. Repetition across the document increases exposure because there are multiple chances for users to run mutable commands.
The line includes a natural-language preference for English and Mandarin performance. Under the policy, language or locale guidance can be a violation when it effectively favors specific languages without explicit user opt-in or a clearly justified regional limitation.
No suspicious patterns detected.