ACE-Step Music Generation

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

This music-generation skill has a coherent purpose, but its installer, local API, and Docker deployment expose users to high-impact execution and network risks that need review before use.

Review this skill before installing. Do not run the curl-to-bash installer as written; download and inspect installers first, pin versions and hashes where possible, and use a dedicated virtual environment. Avoid exposing the Docker or HTTP API beyond localhost, add authentication before agent-to-agent use, and do not send generated audio, prompts, chat IDs, tokens, or webhook URLs to Telegram, Discord, or Feishu unless that external sharing is intentional.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: capsule.json:12
• Finding: Remote Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `capsule.json:12` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Download and execute the installation script curl -fsSL https://evomap.ai/assets/ace-step-deploy.sh | bash ``` ### Technical Analysis The installation instructions pipe an HTTP response directly into Bash. The remote script is hosted at `evomap.ai`, rather than being included as an immutable, locally reviewable component of this package. No version pinning, cryptographic hash, digital signature, or content review step is required before execution. Consequently, the effective installer payload can change after the Skill package has been audited. Compromise of the hosting account, domain, TLS termination infrastructure, or remote asset would allow arbitrary shell code to be delivered to users. This mechanism exceeds the minimum privileges required to install the declared music-generation functionality because it grants an externally controlled response unrestricted code execution with all permissions held by the invoking user. ### Attack Path 1. A user or Agent follows the one-command installation instructions in `capsule.json`. 2. Bash starts and accepts its program text directly from the `curl` process. 3. The remote host supplies the installer response at execution time. 4. If the hosted script or delivery infrastructure has been compromised, the response contains attacker-controlled shell commands. 5. Bash executes those commands immediately without presenting the downloaded file for inspection or verifying its identity. 6. The payload can access or modify any resource available to the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the installer. This can expose user files and credentials, modify shell configuration, install persistence, replace local tools, or ...[truncated 100 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation command. 2. Include the reviewed installer inside the Skill package whenever possible. 3. If remote retrieval is necessary: - Pin the installer to an immutable release or content-addressed URL. - Publish and verify a SHA-256 digest or cryptographic signature. - Download it to a local file before execution. - Abort installation if verification fails. - Require explicit user confirmation after showing the source and verified identity. 4. Use an installation flow similar to: ```bash curl -fL -o ace-step-deploy.sh 'https://trusted.example/releases/v1.0/ace-step-deploy.sh' echo '<EXPECTED_SHA256> ace-step-deploy.sh' | shasum -a 256 -c - less ace-step-deploy.sh bash ace-step-deploy.sh ``` 5. Document the exact release version and trusted signing key. 6. Run installation with ordinary user privileges and never instruct users to add `sudo` unless a narrowly scoped operation demonstrably requires it. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ace_step_agent_server.py:91
• Finding: Unauthenticated Local API Allows Shell Command Injection<![CDATA[ ## Vulnerability Details **File Location**: `ace_step_agent_server.py:91-103, 124-155` **Vulnerability Type**: Shell command injection through request-controlled parameters **Risk Level**: Critical ### Vulnerable Code ```python def _handle_generate(self): """Handle generation request""" try: content_length = int(self.headers.get('Content-Length', 0)) body = self.rfile.read(content_length).decode() params = json.loads(body) prompt = params.get('prompt') duration = params.get('duration', 30) output_path = params.get('output_path') if not prompt: self._send_json({"error": "prompt is required"}, 400) return if not output_path: os.makedirs(OUTPUT_DIR, exist_ok=True) timestamp = int(time.time()) output_path = os.path.join(OUTPUT_DIR, f"agent_{timestamp}.wav") result = self._generate_music(prompt, duration, output_path) self._send_json(result) ``` ```python cmd = f''' source {VENV_PATH}/bin/activate && \ cd {ACE_STEP_HOME} && \ python3 -c " import sys sys.path.insert(0, '{ACE_STEP_HOME}') print('Would generate: prompt={prompt}, duration={duration}, output={output_path}') print('{{\"success\": true, \"file\": \"{output_path}\", \"note\": \"ACE-Step installation pending\"}}') " ''' result = subprocess.run( cmd, shell=True, capture_output=True, text=True, executable='/bin/bash', timeout=300 ) ``` The server also permits wildcard cross-origin requests: ```python self.send_header('Access-Control-Allow-Origin', '*') ``` ### Technical Analysis The `/generate` endpoint accepts `prompt`, `duration`, and `output_path` from JSON and interpolates them directly into a string executed through `subprocess.run(..., shell=True)` using `/bin/bash`. The values cross two executable-language boundaries: a Bash command and nested Python source passed through `python3 -c`. No quoting, escaping, type ...[truncated 1572 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `shell=True` and do not construct a shell program from request data. 2. Invoke the virtual-environment interpreter through a fixed argument array: ```python result = subprocess.run( [os.path.join(VENV_PATH, "bin", "python"), "/fixed/path/generate_helper.py"], input=json.dumps({ "prompt": prompt, "duration": duration, "output_path": output_path, }), text=True, capture_output=True, timeout=300, check=False, ) ``` 3. Parse the JSON in a static helper script and pass values to library APIs as data, not executable source. 4. Require `duration` to be an integer within a conservative range. 5. Resolve and validate `output_path` against an approved output directory; reject traversal and arbitrary absolute paths. 6. Add request-body size limits and generation rate limits. 7. Restrict CORS to explicitly trusted origins or disable browser CORS access entirely. 8. Add an authentication token if more than one trusted local process can reach the endpoint. 9. Keep the listener bound to loopback and run it under a minimally privileged dedicated account where practical. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: ace_step_skill.py:75
• Finding: Music Generation Interfaces Execute User Input as Dynamically Generated Python Code<![CDATA[ ## Vulnerability Details **File Locations**: - `ace_step_skill.py:75-105` - `generate_and_send.py:74-110` - `feishu_music_sender.py:47-82` **Vulnerability Type**: Python code injection **Risk Level**: High ### Vulnerable Code In `ace_step_skill.py`, caller-controlled prompts and output paths are inserted into Python source: ```python script = f''' import sys sys.path.insert(0, "{os.path.expanduser('~/workspace/ace-step')}") from ace_step import MusicGenerator generator = MusicGenerator( model_path="{self.model_path}", device="{self.device}", backend="{self.backend}" ) music = generator.generate( prompt="{prompt}", duration={duration}, temperature={temperature} ) music.save("{output_path}") print(f"SAVED: {{output_path}}") ''' result = self._run_in_venv(["-c", script]) ``` In `generate_and_send.py`, prompt, duration, and output path are likewise interpolated into an executable script: ```python script = f''' import sys sys.path.insert(0, "{ACE_STEP_HOME}") import time import os print(f"Generating: {prompt}, duration={duration}s") import wave import struct import math with wave.open("{output_path}", 'w') as f: f.setnchannels(1) f.setsampwidth(2) f.setframerate(22050) for i in range(22050 * {duration}): value = int(32767.0 * math.sin(2.0 * math.pi * 440.0 * i / 22050)) f.writeframes(struct.pack('h', value)) print(f"SAVED: {output_path}") ''' result = run_in_venv(["-c", script]) ``` In `feishu_music_sender.py`, the same unsafe pattern is used: ```python script = f''' import sys sys.path.insert(0, "{ACE_STEP_HOME}") try: import wave import struct import math with wave.open("{output_path}", 'w') as f: f.setnchannels(1) f.setsampwidth(2) f.setframerate(22050) for i in range(22050 * {duration}): value = int(32767.0 * math.sin(2.0 * math.pi * 440.0 * i / 22050) * 0.5) f.writeframes(struct.pack('h', value)) pr ...[truncated 1834 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Stop generating Python source with f-strings. 2. Create a static helper script or import the ACE-Step library directly in the current process. 3. Pass prompts and paths as ordinary data through: - JSON on standard input, - command-line arguments in an argument array, or - a securely created configuration file. 4. Example static invocation: ```python payload = { "prompt": prompt, "duration": duration, "temperature": temperature, "output_path": output_path, } result = subprocess.run( [str(venv_python), "/fixed/path/generate_helper.py"], input=json.dumps(payload), text=True, capture_output=True, cwd=str(ACE_STEP_HOME), env=env, timeout=300, ) ``` 5. In the helper, parse JSON and pass the resulting strings directly to library methods without `eval`, `exec`, or another `python -c` layer. 6. Enforce sensible numeric bounds for duration and temperature. 7. Resolve output paths and require them to remain within the configured output directory unless the user explicitly authorizes another destination. 8. Add regression tests containing quotes, backslashes, newlines, and code-like prompts to confirm that they remain inert data. ]]>

T06 · System Persistence

Error

• Location: docker-compose.yml:21
• Finding: Persistent Docker Services Publish Unauthenticated Interfaces on All Host Networks<![CDATA[ ## Vulnerability Details **File Location**: `docker-compose.yml:21-38, 50-72` **Vulnerability Type**: Excessive network exposure and persistent service configuration **Risk Level**: High ### Vulnerable Code ```yaml services: ace-step: ports: - "7860:7860" # Gradio UI - "8000:8000" # API service environment: - PYTHONUNBUFFERED=1 - ACE_STEP_DEVICE=cpu - ACE_STEP_PRECISION=float16 - HF_HOME=/app/models restart: unless-stopped ``` ```yaml ace-step-api: command: ["python", "start_api_server.py", "--host", "0.0.0.0", "--port", "8000"] volumes: - ~/Music/ACE-Step:/app/output - ace-step-models:/app/models ports: - "8000:8000" environment: - PYTHONUNBUFFERED=1 - ACE_STEP_API_MODE=1 restart: unless-stopped profiles: ["api"] ``` ### Technical Analysis Docker port mappings without an explicit host address normally bind to all host interfaces. The API command also explicitly listens on `0.0.0.0`. The configuration contains no authentication, TLS, network allowlist, or reverse-proxy access control. Both services use `restart: unless-stopped`, causing them to restart automatically after Docker daemon or host restarts. This creates cross-session persistence beyond an individual music-generation request. The declared local music-generation functionality does not require default exposure to the surrounding network or automatic indefinite restart. The configuration therefore exceeds the minimum access and persistence required for the core task. The two services also both claim host port 8000. Enabling the optional API profile alongside the primary service can produce a port collision. ### Attack Path 1. A user deploys the supplied Compose configuration. 2. Docker publishes ports 7860 and 8000 on the host's network interfaces. 3. The restart policy keeps the service available across Docker or host restarts. 4. A device able to reach the host conn ...[truncated 779 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind published ports to loopback unless remote access is explicitly required: ```yaml ports: - "127.0.0.1:7860:7860" - "127.0.0.1:8000:8000" ``` 2. Configure the application itself to listen on `127.0.0.1` where container architecture permits it. 3. Add strong authentication, authorization, request-size controls, and rate limiting. 4. If remote access is required, place the service behind a TLS-enabled authenticated reverse proxy and restrict source networks with firewall rules. 5. Replace `restart: unless-stopped` with `restart: "no"` or `on-failure` unless the user explicitly opts into persistent operation. 6. Expose only the UI or API actually required, not both by default. 7. Resolve the duplicate host-port assignment before enabling the API profile. 8. Apply container hardening such as a non-root user, read-only root filesystem where feasible, dropped Linux capabilities, and narrowly scoped volume mounts. ]]>

T08 · Insecure Dependencies

Warning

• Location: ace-step-deploy.sh:34
• Finding: Installation Executes Unpinned Third-Party Repository and Package Content<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:35-46` - `ace-step-deploy.sh:34-82` - `install_ace_step.sh:76-125` **Vulnerability Type**: Unpinned software supply-chain dependencies **Risk Level**: Medium ### Vulnerable Code The documented installation retrieves the current repository state and performs an editable installation: ```bash git clone https://github.com/ace-step/ACE-Step-1.5.git ~/workspace/ace-step cd ~/workspace/ace-step pip install -e ".[mlx]" # Or use the repository-provided script ./scripts/install_macos.sh ``` The deployment script installs packages without version or hash pinning: ```bash git clone --depth 1 https://github.com/ace-step/ACE-Step.git "$INSTALL_DIR" pip install --upgrade pip -q pip install mlx mlx-lm -q pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu -q pip install transformers accelerate safetensors -q pip install soundfile librosa -q cd "$INSTALL_DIR" pip install -e . -q || pip install -e ".[mlx]" -q ``` The alternative installer has similar behavior and an unpinned package fallback: ```bash pip install mlx mlx-lm -q || echo "${YELLOW}MLX installation may have failed; continuing..." pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu -q || true pip install transformers accelerate safetensors -q || true pip install soundfile librosa -q || true if git clone --depth 1 https://github.com/ace-step/ACE-Step-1.5.git tmp_repo; then mv tmp_repo/* . rm -rf tmp_repo fi if [ ! -f "$INSTALL_DIR/README.md" ]; then pip install ace-step -q || echo "${YELLOW}pip installation also failed${NC}" fi ``` ### Technical Analysis Repository branches and package names are mutable references. No reviewed Git commit, package version, lockfile, package hash, model checksum, or signature is enforced. `pip install -e` processes build metadata from freshly downloaded repository content. The documented option to run the upstream `scri ...[truncated 1365 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin ACE-Step to a reviewed full Git commit hash rather than a moving branch. 2. Prefer signed release tags and verify the tag signature before installation. 3. Replace free-form pip commands with a lockfile containing exact versions and hashes. 4. Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 5. Pin the pip installer version rather than upgrading to whatever version is newest. 6. Avoid editable installations for production deployments. 7. Review repository build metadata and installation scripts before execution. 8. Publish SHA-256 checksums for all manually downloaded model files and verify them before loading. 9. Remove or pin the `pip install ace-step` fallback so an unexpected package release cannot silently replace the intended repository. 10. Use a dedicated virtual environment with no access to unrelated application secrets. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

'''
        
        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True,

• Confidence: 99% confidence
• Finding: This is a classic tool-parameter abuse issue: untrusted API input is fed into a shell-backed subprocess, allowing an attacker to manipulate the tool invocation itself. In the context of an HTTP server, this is especially dangerous because any local process able to reach the service can potentially achieve arbitrary code execution as the server user.

External Script Fetching

High

• Category: Supply Chain

Content

],
  "gene": "sha256:07af290b1b4ae9e0dfaaa5e7b0f9b6888f7e763f38b1e6b524ff8c21941227ae",
  "summary": "在 macOS Apple Silicon 上完整部署 ACE-Step 1.5 AI音乐生成模型，使用MLX加速，支持本地文本生成音乐",
  "content": "# ACE-Step 1.5 Mac 部署指南\n\n## 概述\n本方案在 macOS Apple Silicon (M1/M2/M3/M4) 上部署 ACE-Step 1.5，一个开源的AI音乐生成模型。使用 Apple 的 MLX 框架进行加速，无需 GPU 即可实现高效的本地音乐生成。\n\n## 硬件要求\n- **芯片**: Apple Silicon (M1/M2/M3/M4)\n- **内存**: 16GB+ (推荐 32GB)\n- **存储**: 10GB+ 可用空间\n- **系统**: macOS 13.0+\n\n## 部署步骤\n\n### 1. 一键安装脚本\n```bash\n# 下载并执行安装脚本\ncurl -fsSL https://evomap.ai/assets/ace-step-deploy.sh | bash\n```\n\n### 2. 手动安装\n\n#### 2.1 克隆仓库\n```bash\nmkdir -p ~/workspace\ncd ~/workspace\ngit clone --depth 1 https://github.com/ace-step/ACE-Step.git ace-step\n```\n\n#### 2.2 创建虚拟环境\n```bash\npython3 -m venv ~/ace-step-env\nsource ~/ace-step-env/bin/activate\n```\n\n#### 2.3 安装依赖\n```bash\npip install --upgrade pip\n\n# Apple Silicon 加速库\npip install mlx mlx-lm\n\n# 深度学习框架\npip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu\n\n# 其他依赖\npip install transformers accelerate safetensors\npip install soundfile librosa\n```\n\n#### 2.4 安装 ACE-Step\n```bash\ncd ~/workspace/ace-step\npip install -e .\n```\n\n#### 2.5 下载模型 (~10GB)\n```bash\nmkdir -p checkpoints\n\n# VAE (336MB)\ncurl -L -o checkpoints/vae/diffusion_pytorch_model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/vae/diffusion_pytorch_model.safetensors\n\n# Qwen3 Embedding (1.1GB)\ncurl -L -o checkpoints/Qwen3-Embedding-0.6B/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/Qwen3-Embedding-0.6B/model.safetensors\n\n# LM (3.5GB)\ncurl -L -o checkpoints/acestep-5Hz-lm-1.7B/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/acestep-5Hz-lm-1.7B/model.safetensors\n\n# DiT Turbo (4.5GB)\ncurl -L -o checkpoints/acestep-v15-turbo/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/acestep-v15-turbo/model.safeten
...[truncated 26 chars]

• Confidence: 99% confidence
• Finding: This is a direct external-script execution pattern: `curl -fsSL https://evomap.ai/assets/ace-step-deploy.sh | bash`. In a deployment skill, this is especially risky because users are primed to copy-paste installation commands, making arbitrary code execution on their machine highly plausible if the host, network path, or script content is malicious or later altered.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def run_in_venv(cmd: list, cwd: str = None) -> subprocess.CompletedProcess:
    """在虚拟环境中运行命令"""
    venv_python = VENV_PATH / "bin" / "python"
    env = os.environ.copy()
    env["PATH"] = str(VENV_PATH / "bin") + ":" + env.get("PATH", "")
    
    full_cmd = [str(venv_python)] + cmd

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def run_in_venv(cmd: list, cwd: str = None) -> subprocess.CompletedProcess:
    """在虚拟环境中运行命令"""
    venv_python = VENV_PATH / "bin" / "python"
    env = os.environ.copy()
    env["PATH"] = str(VENV_PATH / "bin") + ":" + env.get("PATH", "")
    
    full_cmd = [str(venv_python)] + cmd

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Credential Access

High

• Category: Privilege Escalation

Content

"constraints": {
    "max_files": 10,
    "forbidden_paths": [
      ".env",
      "secrets",
      "api_keys"
    ],

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

"constraints": {
    "max_files": 10,
    "forbidden_paths": [
      ".env",
      "secrets",
      "api_keys"
    ],

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium

• Category: Data Exfiltration

Content

**检查状态:**
```bash
curl http://localhost:8765/status
```

**生成音乐:**

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# 生成音乐
response = requests.post('http://localhost:8765/generate', json={
    'prompt': 'Upbeat electronic music',
    'duration': 60,
    'output_path': '/tmp/my_music.wav'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

# 生成音乐
response = requests.post('http://localhost:8765/generate', json={
    'prompt': 'Upbeat electronic music',
    'duration': 60,
    'output_path': '/tmp/my_music.wav'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Internal Network Request

Medium

• Category: Server-Side Request Forgery

Content

import requests

# 生成音乐
response = requests.post('http://localhost:8765/generate', json={
    'prompt': 'Upbeat electronic music',
    'duration': 60,
    'output_path': '/tmp/my_music.wav'

• Confidence: 70% confidence
• Finding: Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

External Transmission

Medium

• Category: Data Exfiltration

Content

python3 skills/ace-step/ace_step_agent_server.py

# 2. 测试调用 (终端 2)
curl http://localhost:8765/status
curl -X POST http://localhost:8765/generate \
  -H "Content-Type: application/json" \
  -d '{"prompt": "test", "duration": 10}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guide instructs users to send generated audio and prompt text to external services but does not clearly warn that both the media and associated metadata/content will leave the local system. This creates a real privacy and data-governance risk, especially if prompts or audio contain sensitive, proprietary, or personal information.

Ssd 3

Medium

• Confidence: 81% confidence
• Finding: The guide includes a concrete-looking Telegram bot token format directly in the setup steps, framed as something to obtain and use for automated sending. Even though it is presented as documentation, this is natural-language guidance that normalizes handling and reuse of sensitive access credentials in a sharable file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The Telegram Bot example uploads a local audio file to Telegram without warning that the file, chat identifier, and related metadata are sent to an external platform. Users may unintentionally disclose sensitive content because the workflow is presented as routine automation rather than an explicit outbound-sharing step.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. **发送文件**:
   ```bash
   curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendAudio" \
       -F "chat_id=${TELEGRAM_CHAT_ID}" \
       -F "audio=@/path/to/music.wav" \
       -F "caption=🎵 ACE-Step Generated"

• Confidence: 95% confidence
• Finding: The URL is part of a curl command that uploads a local audio file to Telegram, making it a true external transmission path. The danger is contextual rather than malicious: the skill is a sending guide, but absent clear warnings and consent controls, users may unintentionally exfiltrate sensitive local content.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. **发送文件**:
   ```bash
   curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendAudio" \
       -F "chat_id=${TELEGRAM_CHAT_ID}" \
       -F "audio=@/path/to/music.wav" \
       -F "caption=🎵 ACE-Step Generated"

• Confidence: 95% confidence
• Finding: The URL is part of a curl command that uploads a local audio file to Telegram, making it a true external transmission path. The danger is contextual rather than malicious: the skill is a sending guide, but absent clear warnings and consent controls, users may unintentionally exfiltrate sensitive local content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Discord webhook instructions send a local file to an externally reachable webhook endpoint without clearly informing the user that the upload leaves the device and may be exposed to channel members or anyone with webhook access. This omission increases the chance of accidental disclosure of local content.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language content throughout the skill file is presented in Chinese, including operational instructions and usage guidance. Under the policy, forcing a specific language without user opt-in or a documented locale-specific justification is a language/locale policy violation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document instructs users to configure Telegram bot tokens and Discord webhook URLs and then automatically send generated content to external services, but it does not clearly warn that doing so transmits files, metadata, and sensitive service credentials outside the local environment. This can lead to unintended disclosure of generated media, chat identifiers, or mishandling of secrets if users copy these patterns into agent automation without understanding the trust boundary.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The FAQ recommends full automation via Telegram Bot or Discord Webhook with 'no human intervention,' but it omits a warning that music files or shared links may be sent externally without further review. In an agent context, this increases the chance of accidental exfiltration of sensitive generated content or sending to the wrong recipient/channel.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: User-facing comments and help/instructional strings in this skill are written only in Chinese, including operational guidance such as installation instructions. This imposes a specific language/locale without any stated opt-in or alternative, which matches the policy's language-choice concern.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script writes executable Python code to a predictable, world-accessible path in /tmp and then executes it. An attacker on the same system could exploit symlink or race-condition behavior to overwrite arbitrary files or replace the temporary script before execution, potentially leading to code execution in the context of the user running this agent.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The surrounding comments and help text present `status` as a supported interface command, suggesting it returns usable structured status information. However, `get_status` calls `check_installation` (which already prints a complete JSON object) and then appends stray fields and a closing brace, producing contradictory output rather than a valid single status object.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Nearly all user-facing messages and usage instructions in the script are written in Chinese, which implicitly fixes the interaction locale. There is no opt-in, fallback, or documented justification that this skill is intended only for Chinese-speaking users or a China-specific environment.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code performs a file write by creating a new script under the chosen installation path and then marks it executable. Although the script prints progress messages, it does not specifically warn the user beforehand that it will create or overwrite this file, and there is no confirmation prompt around that filesystem change.

Static analysis

No suspicious patterns detected.