ClawHub
Back to skill

Security audit

Jingle Forge

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent SenseAudio jingle generator, but its shell templates handle user-supplied brand text unsafely and send campaign details to an external service with limited upfront disclosure.

Review this skill before installing. Use it only with non-confidential brand/campaign details you are willing to send to SenseAudio, and do not run the included bash templates with raw user text unless they are rewritten to build JSON safely with jq or another serializer and bounded polling timeouts.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:63
Finding
Command Injection Through Unsafe User-Controlled Value Interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 63–66; the same unsafe pattern also appears at lines 111–138 and 158–170. **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```bash LYRICS_RESP=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{\"prompt\": \"<PROMPT>\", \"provider\": \"sensesong\"}") ``` Additional affected code includes: ```bash SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"sensesong\", \"lyrics\": \"<LYRICS>\", \"title\": \"<品牌名> Jingle\", \"vocal_gender\": \"<f|m>\", \"style\": \"<STYLE>, short jingle, 5-15 seconds, brand audio logo\", \"negative_tags\": \"long intro, extended outro, complex arrangement\" }") TASK_A=$(echo $SONG_A | jq -r '.task_id') ``` ```bash SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"sensesong\", \"instrumental\": true, \"title\": \"<品牌名> Jingle Instrumental\", \"style\": \"<STYLE>, short jingle, 5-15 seconds, brand audio logo\", \"negative_tags\": \"vocals, long intro, extended outro\" }") TASK_B=$(echo $SONG_B | jq -r '.task_id') ``` ```bash curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"SenseAudio-TTS-1.0\", \"text\": \"<品牌名>\", \"stream\": false, \"voice_setting\": { \"voice_id\": \"<VOICE_ID_MATCHING_TONE>\", \"speed\": 0.9 }, \"audio_setting\": { \"format\": \"mp3\" } }" -o brand_name.json ``` ### Technical Analysis The Skill instructs ...[truncated 2136 chars]
Remediation
<![CDATA[ ## Remediation Suggestions Do not insert user-controlled text into generated shell source or manually escaped JSON strings. 1. Store each user-derived value in a shell variable without evaluating it as code. 2. Construct all JSON request bodies with `jq -n --arg` or a language-native JSON serializer. 3. Pass the resulting payload to `curl` using `--data-binary`. 4. Validate allowed values for enumerated fields such as vocal gender, voice ID, and output format. 5. Avoid `eval`, shell re-parsing, or any textual replacement that turns user data into executable shell syntax. 6. Use `curl --fail-with-body -sS` so HTTP failures are handled explicitly. 7. Run the Skill with a minimally privileged account and expose only the credential required for the current operation. A safer pattern is: ```bash payload=$(jq -n \ --arg prompt "$PROMPT" \ '{prompt: $prompt, provider: "sensesong"}') curl --fail-with-body -sS \ -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` Apply the same construction method independently to the lyrics, music, and text-to-audio requests. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:72
Finding
Unbounded API Polling Can Cause Indefinite Execution and Resource Consumption<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 72–78; a second affected polling flow appears at lines 143–151. **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Low ### Vulnerable Code ```bash while true; do POLL=$(curl -s "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY") STATUS=$(echo $POLL | jq -r '.status') { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break sleep 3 done ``` The music-generation polling flow has the same issue: ```bash for TASK in $TASK_A $TASK_B; do while true; do POLL=$(curl -s "https://api.senseaudio.cn/v1/song/music/pending/$TASK" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY") STATUS=$(echo $POLL | jq -r '.status') { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break sleep 5 done done ``` ### Technical Analysis Both polling implementations use `while true` without a maximum attempt count or overall deadline. The `curl` calls do not set connection or request timeouts and do not fail on HTTP errors. Responses are not validated before reading `.status`. If the network is unavailable, the service repeatedly returns malformed data, an unexpected status is returned, or a task never reaches a terminal state, the loop can continue indefinitely. Empty or invalid responses also produce a status that does not match either terminal value, causing further retries. ### Attack Path 1. A generation request returns a task identifier. 2. The remote service, a network intermediary, or a service failure causes polling responses to remain nonterminal, empty, malformed, or erroneous. 3. The script fails to recognize either `SUCCESS` or `FAILED`. 4. The unconditional loop continues issuing authenticated requests every three or five seconds. 5. The Agent session remains occupied until manually terminated and continues consuming local and remote resources. ### Impact Ass ...[truncated 414 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Set a fixed maximum number of polling attempts or an absolute deadline. 2. Add connection and total request timeouts to every `curl` invocation. 3. Use `--fail-with-body -sS` and terminate or retry with bounded exponential backoff on HTTP failures. 4. Validate that the response is valid JSON and that `.status` is a recognized value. 5. Treat unknown terminal states as explicit errors rather than polling forever. 6. Report timeout and service errors clearly to the user. 7. Consider respecting a server-provided retry interval when available. Example: ```bash max_attempts=40 for attempt in $(seq 1 "$max_attempts"); do if ! POLL=$(curl --fail-with-body -sS \ --connect-timeout 10 \ --max-time 30 \ "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY"); then echo "Polling request failed" >&2 exit 1 fi STATUS=$(printf '%s' "$POLL" | jq -er '.status') || { echo "Invalid polling response" >&2 exit 1 } case "$STATUS" in SUCCESS|FAILED) break ;; PENDING|PROCESSING) sleep 3 ;; *) echo "Unexpected task status: $STATUS" >&2 exit 1 ;; esac if [ "$attempt" -eq "$max_attempts" ]; then echo "Task polling timed out" >&2 exit 1 fi done ``` ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description lists several specific trigger phrases, but then expands scope to "any request to create a short branded musical piece." That catch-all is broad enough to overlap with many ordinary creative-audio requests, making it unclear when this skill should activate versus other music-generation skills.

Natural-Language Policy Violations

Medium
Confidence
82% confidence
Finding
The trigger examples and much of the operational content are written only in Chinese, which implicitly constrains invocation and expected usage to a specific language without stating that this is intentional or optional. The file does not offer a language choice or document a justified locale restriction.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill sends user-supplied brand names, industry details, tone keywords, and usage scenarios to an external API without an upfront disclosure at the point of collection. This creates a privacy and data-governance risk, especially for confidential campaign plans or unreleased brand assets.

External Transmission

Medium
Category
Data Exfiltration
Content
```

```bash
LYRICS_RESP=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"prompt\": \"<PROMPT>\", \"provider\": \"sensesong\"}")
Confidence
95% confidence
Finding
Referencing and invoking the external SenseAudio endpoint confirms third-party data transfer for lyric generation. In this skill context, the danger is not the domain itself but undisclosed export of potentially sensitive branding data.

External Transmission

Medium
Category
Data Exfiltration
Content
```

```bash
LYRICS_RESP=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"prompt\": \"<PROMPT>\", \"provider\": \"sensesong\"}")
Confidence
95% confidence
Finding
Referencing and invoking the external SenseAudio endpoint confirms third-party data transfer for lyric generation. In this skill context, the danger is not the domain itself but undisclosed export of potentially sensitive branding data.

External Transmission

Medium
Category
Data Exfiltration
Content
If async (`task_id` present), poll:
```bash
while true; do
  POLL=$(curl -s "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \
    -H "Authorization: Bearer $SENSEAUDIO_API_KEY")
  STATUS=$(echo $POLL | jq -r '.status')
  { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
If async (`task_id` present), poll:
```bash
while true; do
  POLL=$(curl -s "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \
    -H "Authorization: Bearer $SENSEAUDIO_API_KEY")
  STATUS=$(echo $POLL | jq -r '.status')
  { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**Version A — 带唱版 (with vocals):**
```bash
SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This endpoint entry again reflects substantive outbound transfer of brand and lyric data for music generation. Because the skill is designed around external synthesis, the risk is contextual and primarily about confidentiality and informed consent rather than malicious exfiltration.

External Transmission

Medium
Category
Data Exfiltration
Content
**Version A — 带唱版 (with vocals):**
```bash
SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This endpoint entry again reflects substantive outbound transfer of brand and lyric data for music generation. Because the skill is designed around external synthesis, the risk is contextual and primarily about confidentiality and informed consent rather than malicious exfiltration.

External Transmission

Medium
Category
Data Exfiltration
Content
**Version B — 纯音乐版 (instrumental):**
```bash
SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This external instrumental-generation endpoint receives user-derived creative metadata and branding context. In a marketing workflow, that may expose proprietary naming or positioning information if the user is not warned.

External Transmission

Medium
Category
Data Exfiltration
Content
**Version B — 纯音乐版 (instrumental):**
```bash
SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This external instrumental-generation endpoint receives user-derived creative metadata and branding context. In a marketing workflow, that may expose proprietary naming or positioning information if the user is not warned.

External Transmission

Medium
Category
Data Exfiltration
Content
Generate a clean spoken version of the brand name — useful for overlaying on the instrumental:

```bash
curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This TTS endpoint is a real external transmission of user-derived brand data to a third-party provider. The context makes it somewhat less dangerous than arbitrary exfiltration because it is functionally related to the skill, but it still expands disclosure scope beyond what many users may expect.

External Transmission

Medium
Category
Data Exfiltration
Content
Generate a clean spoken version of the brand name — useful for overlaying on the instrumental:

```bash
curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
Confidence
95% confidence
Finding
This TTS endpoint is a real external transmission of user-derived brand data to a third-party provider. The context makes it somewhat less dangerous than arbitrary exfiltration because it is functionally related to the skill, but it still expands disclosure scope beyond what many users may expect.

Description-Behavior Mismatch

Low
Confidence
95% confidence
Finding
The manifest and introductory description scope the skill to creating a 5–15 second branded musical piece. However, Step 5 adds a distinct text-to-speech capability to synthesize a spoken brand-name clip and the output section presents it as a third deliverable, which goes beyond just generating a jingle.

Context-Inappropriate Capability

Low
Confidence
91% confidence
Finding
A brand-jingle generator would be expected to call music and lyric generation APIs, but generating a separate spoken brand-name file is an additional audio-production feature. The manifest does not describe voice synthesis, narration, or spoken overlays as part of the skill's purpose.

Natural-Language Policy Violations

Low
Confidence
76% confidence
Finding
The skill instructs fixed voice selection based on tone keywords and uses preset IDs in a workflow otherwise centered on Chinese-language content, but it does not tell the user they can choose another language or locale. This creates an implicit locale preference without opt-in or justification.

Static analysis

No suspicious patterns detected.