ACE-Step Music Generation

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.0.0

Overview

The skill has a coherent local AI music purpose, but its installer and agent interfaces create review-worthy command-execution and data-sharing risks.

Review carefully before installing. Prefer the manual install steps over the curl-to-bash command, do not expose or use the localhost API with untrusted callers, keep output paths inside a dedicated music directory, and avoid sending generated files or prompts to Telegram, Discord, or Feishu unless you are comfortable sharing that data with those services.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'''
        
        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True,

• Confidence: 99% confidence
• Finding: result = subprocess.run( cmd, shell=True, capture_output=True, text=True, executable='/bin/bash',

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env["PATH"] = str(VENV_PATH / "bin") + ":" + env.get("PATH", "")
    
    full_cmd = [str(venv_python)] + cmd
    return subprocess.run(
        full_cmd,
        capture_output=True,
        text=True,

• Confidence: 90% confidence
• Finding: return subprocess.run( full_cmd, capture_output=True, text=True, cwd=cwd or str(ACE_STEP_HOME), env=env )

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The docstring says the path returns a simulated result because installation is incomplete, but the implementation still launches a shell and executes dynamically constructed code. This mismatch is dangerous because reviewers or operators may underestimate the execution risk and expose the endpoint assuming it is non-operational or harmless.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill dynamically builds a Python script string and executes it with python -c, interpolating untrusted values such as prompt, output_path, and model_path directly into source code. A crafted input containing quotes and Python statements can break out of the intended string literal and execute arbitrary Python code in the subprocess.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation explicitly instructs callers to supply arbitrary output paths such as '/tmp/my_music.wav' without any warning about overwrite behavior, path restrictions, or validation. In an agent setting, this can normalize unsafe file-write patterns and lead downstream implementations to overwrite sensitive files or write outside intended directories if they honor user-controlled paths.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide provides concrete examples for uploading generated audio to third-party services and may also include prompt text in captions/messages, but it does not warn users that audio and prompts will leave the local machine and be processed by external providers. This creates a real privacy and data-sharing risk, especially if prompts or generated content are sensitive, proprietary, or user-identifying.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly instructs users and agents to transmit generated music and related file-path information to external services such as Telegram, Discord, and OpenClaw, but it does not provide meaningful warnings about privacy, data handling, recipient validation, or accidental disclosure. In an agent skill context, this normalizes exfiltration-like behavior and increases the chance that local content or sensitive path metadata is sent to third parties without user awareness or approval.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script writes executable Python code to a predictable path in /tmp and then executes it. On multi-user systems this can enable symlink or race-condition attacks, letting another local user replace or redirect the file and potentially achieve code execution or overwrite unintended files with the privileges of the script runner.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Request-supplied parameters are sent into a shell execution path without any warning, confirmation, or validation. In this context, lack of disclosure is not just a UX issue: it hides that untrusted API input can directly influence command execution, increasing the chance this endpoint is used unsafely by other agents or services.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill instructs users to fetch and immediately execute a remote shell script via `curl ... | bash`, which bypasses inspection and gives the remote server direct code execution on the user's machine. In this context, the skill is a deployment guide for local setup, so users are especially likely to copy-paste the command with full trust, increasing the chance of compromise if the script is malicious, replaced, or the hosting site is breached.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases "deploy ace-step" and especially "ai music setup" are broad and lack clear activation constraints, which can cause the skill to activate in unintended contexts. Because the skill appears to perform deployment and environment setup actions, accidental invocation could lead to unreviewed package installation, repository cloning, or model downloads on a user's macOS system.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script can transmit local or generated audio files to Telegram or Discord over the network with only command-line selection and no clear warning in the tool description about external delivery. In an agent-skill context, automatic outbound transfer of user files is security-relevant because users may not realize content leaves the local environment or may supply sensitive files via --send-only.

External Transmission

Medium

• Category: Data Exfiltration

Content

4. **发送文件**:
   ```bash
   curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendAudio" \
       -F "chat_id=${TELEGRAM_CHAT_ID}" \
       -F "audio=@/path/to/music.wav" \
       -F "caption=🎵 ACE-Step Generated"

• Confidence: 87% confidence
• Finding: curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendAudio" \ -F "chat_id=${TELEGRAM_CHAT_ID}" \ -F "audio=@/path/to/music.wav" \ -F "caption=🎵 ACE-Step Generated"

External Transmission

Medium

• Category: Data Exfiltration

Content

4. **发送文件**:
   ```bash
   curl -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendAudio" \
       -F "chat_id=${TELEGRAM_CHAT_ID}" \
       -F "audio=@/path/to/music.wav" \
       -F "caption=🎵 ACE-Step Generated"

• Confidence: 87% confidence
• Finding: https://api.telegram.org/

External Script Fetching

High

• Category: Supply Chain

Content

],
  "gene": "sha256:07af290b1b4ae9e0dfaaa5e7b0f9b6888f7e763f38b1e6b524ff8c21941227ae",
  "summary": "在 macOS Apple Silicon 上完整部署 ACE-Step 1.5 AI音乐生成模型，使用MLX加速，支持本地文本生成音乐",
  "content": "# ACE-Step 1.5 Mac 部署指南\n\n## 概述\n本方案在 macOS Apple Silicon (M1/M2/M3/M4) 上部署 ACE-Step 1.5，一个开源的AI音乐生成模型。使用 Apple 的 MLX 框架进行加速，无需 GPU 即可实现高效的本地音乐生成。\n\n## 硬件要求\n- **芯片**: Apple Silicon (M1/M2/M3/M4)\n- **内存**: 16GB+ (推荐 32GB)\n- **存储**: 10GB+ 可用空间\n- **系统**: macOS 13.0+\n\n## 部署步骤\n\n### 1. 一键安装脚本\n```bash\n# 下载并执行安装脚本\ncurl -fsSL https://evomap.ai/assets/ace-step-deploy.sh | bash\n```\n\n### 2. 手动安装\n\n#### 2.1 克隆仓库\n```bash\nmkdir -p ~/workspace\ncd ~/workspace\ngit clone --depth 1 https://github.com/ace-step/ACE-Step.git ace-step\n```\n\n#### 2.2 创建虚拟环境\n```bash\npython3 -m venv ~/ace-step-env\nsource ~/ace-step-env/bin/activate\n```\n\n#### 2.3 安装依赖\n```bash\npip install --upgrade pip\n\n# Apple Silicon 加速库\npip install mlx mlx-lm\n\n# 深度学习框架\npip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cpu\n\n# 其他依赖\npip install transformers accelerate safetensors\npip install soundfile librosa\n```\n\n#### 2.4 安装 ACE-Step\n```bash\ncd ~/workspace/ace-step\npip install -e .\n```\n\n#### 2.5 下载模型 (~10GB)\n```bash\nmkdir -p checkpoints\n\n# VAE (336MB)\ncurl -L -o checkpoints/vae/diffusion_pytorch_model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/vae/diffusion_pytorch_model.safetensors\n\n# Qwen3 Embedding (1.1GB)\ncurl -L -o checkpoints/Qwen3-Embedding-0.6B/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/Qwen3-Embedding-0.6B/model.safetensors\n\n# LM (3.5GB)\ncurl -L -o checkpoints/acestep-5Hz-lm-1.7B/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/acestep-5Hz-lm-1.7B/model.safetensors\n\n# DiT Turbo (4.5GB)\ncurl -L -o checkpoints/acestep-v15-turbo/model.safetensors \\\n  https://huggingface.co/ACE-Step/Ace-Step1.5/resolve/main/acestep-v15-turbo/model.safeten
...[truncated 26 chars]

• Confidence: 100% confidence
• Finding: curl -fsSL https://evomap.ai/assets/ace-step-deploy.sh | bash

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.