Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward guide for generating instrumental background music through Replicate, with expected API use and no hidden persistence or bundled executable code.
Before installing, verify that the PrunaAI/pruna-skills source and any `npx skills add` command are trusted in your environment. Use a Replicate token intended for this work, review prompts before sending them to Replicate, and avoid including secrets or private content in generated-audio prompts.
The skill instructs users to run npx skills add ... without pinning an immutable version for the skills package/runner itself. That creates a supply-chain risk: a future compromised or maliciously updated package resolved by npx could execute arbitrary code on the user's machine during installation.
This line again directs runtime package execution via npx skills add ... without pinning the executed tool version. If the skills package or its resolution path is hijacked, the installation step can run attacker-controlled code with the user's privileges.
The skill references npx skills as an install path without a pinned executable version, exposing users to dependency confusion or malicious upstream updates. Because npx may download and execute code immediately, compromise of the package ecosystem directly impacts the endpoint running the command.
The 'full suite' install also uses unpinned npx skills, carrying the same supply-chain execution risk. A single compromised package update could affect all users following the documentation and pull in a broader set of code than the minimal skill install.
The redirect instruction to install music-2.5 via unpinned npx skills introduces the same remote code execution-by-install risk. Even though this is a fallback path, users may still execute it directly from the skill guidance.
This npx skills add command is another unpinned runtime package execution point. The risk is contextualized by the skill being operational guidance: users are likely to copy-paste commands verbatim, increasing exploitability if the package source is compromised.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST \
-H "Authorization: Bearer ${REPLICATE_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"cfg_scale": 1
}
}'
"https://api.replicate.com/v1/models/stability-ai/stable-audio-2.5/predictions"
Poll `urls.get` until `status` is `succeeded`; download `output` MP3.
The 'Typical next steps' section continues recommending unpinned npx skills installation commands. This broadens the attack surface by normalizing repeated execution of remotely resolved packages across multiple follow-on workflows.
This installation command is vulnerable for the same reason: unpinned npx execution can resolve and run unexpected code. Because it appears in a convenience section, users may treat it as trusted boilerplate and execute it without review.
The final npx skills add example remains an unpinned remote execution vector. In aggregate, repeated unpinned commands materially increase supply-chain exposure throughout the skill's documented workflow.
No suspicious patterns detected.