Jingle Forge

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:49 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent SenseAudio jingle generator, but its shell templates handle user-supplied brand text unsafely and send campaign details to an external service with limited upfront disclosure.

Review this skill before installing. Use it only with non-confidential brand/campaign details you are willing to send to SenseAudio, and do not run the included bash templates with raw user text unless they are rewritten to build JSON safely with jq or another serializer and bounded polling timeouts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63

Finding

Command Injection Through Unsafe User-Controlled Value Interpolation

Content

View full analysis

\", \"provider\": \"sensesong\"}") ``` Additional affected code includes: ```bash SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"sensesong\", \"lyrics\": \"\", \"title\": \"<品牌名> Jingle\", \"vocal_gender\": \"\", \"style\": \", short jingle, 5-15 seconds, brand audio logo\", \"negative_tags\": \"long intro, extended outro, complex arrangement\" }") TASK_A=$(echo $SONG_A | jq -r '.task_id') ``` ```bash SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"sensesong\", \"instrumental\": true, \"title\": \"<品牌名> Jingle Instrumental\", \"style\": \"<STYLE>, short jingle, 5-15 seconds, brand audio logo\", \"negative_tags\": \"vocals, long intro, extended outro\" }") TASK_B=$(echo $SONG_B | jq -r '.task_id') ``` ```bash curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"SenseAudio-TTS-1.0\", \"text\": \"<品牌名>\", \"stream\": false, \"voice_setting\": { \"voice_id\": \"<VOICE_ID_MATCHING_TONE>\", \"speed\": 0.9 }, \"audio_setting\": { \"format\": \"mp3\" } }" -o brand_name.json ``` ### Technical Analysis The Skill instructs ...[truncated 2136 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:72

Finding

Unbounded API Polling Can Cause Indefinite Execution and Resource Consumption

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi STATUS=$(printf '%s' "$POLL" | jq -er '.status') || { echo "Invalid polling response" >&2 exit 1 } case "$STATUS" in SUCCESS|FAILED) break ;; PENDING|PROCESSING) sleep 3 ;; *) echo "Unexpected task status: $STATUS" >&2 exit 1 ;; esac if [ "$attempt" -eq "$max_attempts" ]; then echo "Task polling timed out" >&2 exit 1 fi done ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description lists several specific trigger phrases, but then expands scope to "any request to create a short branded musical piece." That catch-all is broad enough to overlap with many ordinary creative-audio requests, making it unclear when this skill should activate versus other music-generation skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The trigger examples and much of the operational content are written only in Chinese, which implicitly constrains invocation and expected usage to a specific language without stating that this is intentional or optional. The file does not offer a language choice or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user-supplied brand names, industry details, tone keywords, and usage scenarios to an external API without an upfront disclosure at the point of collection. This creates a privacy and data-governance risk, especially for confidential campaign plans or unreleased brand assets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Referencing and invoking the external SenseAudio endpoint confirms third-party data transfer for lyric generation. In this skill context, the danger is not the domain itself but undisclosed export of potentially sensitive branding data.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

text

```bash
LYRICS_RESP=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"prompt\": \"<PROMPT>\", \"provider\": \"sensesong\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Referencing and invoking the external SenseAudio endpoint confirms third-party data transfer for lyric generation. In this skill context, the danger is not the domain itself but undisclosed export of potentially sensitive branding data.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

text

```bash
LYRICS_RESP=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/lyrics/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"prompt\": \"<PROMPT>\", \"provider\": \"sensesong\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

If async (task_id present), poll:

bash

while true; do
  POLL=$(curl -s "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \
    -H "Authorization: Bearer $SENSEAUDIO_API_KEY")
  STATUS=$(echo $POLL | jq -r '.status')
  { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

If async (task_id present), poll:

bash

while true; do
  POLL=$(curl -s "https://api.senseaudio.cn/v1/song/lyrics/pending/$TASK_ID" \
    -H "Authorization: Bearer $SENSEAUDIO_API_KEY")
  STATUS=$(echo $POLL | jq -r '.status')
  { [ "$STATUS" = "SUCCESS" ] || [ "$STATUS" = "FAILED" ]; } && break

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This endpoint entry again reflects substantive outbound transfer of brand and lyric data for music generation. Because the skill is designed around external synthesis, the risk is contextual and primarily about confidentiality and informed consent rather than malicious exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Version A — 带唱版 (with vocals):

bash

SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This endpoint entry again reflects substantive outbound transfer of brand and lyric data for music generation. Because the skill is designed around external synthesis, the risk is contextual and primarily about confidentiality and informed consent rather than malicious exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Version A — 带唱版 (with vocals):

bash

SONG_A=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This external instrumental-generation endpoint receives user-derived creative metadata and branding context. In a marketing workflow, that may expose proprietary naming or positioning information if the user is not warned.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

Version B — 纯音乐版 (instrumental):

bash

SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This external instrumental-generation endpoint receives user-derived creative metadata and branding context. In a marketing workflow, that may expose proprietary naming or positioning information if the user is not warned.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

Version B — 纯音乐版 (instrumental):

bash

SONG_B=$(curl -s -X POST "https://api.senseaudio.cn/v1/song/music/create" \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This TTS endpoint is a real external transmission of user-derived brand data to a third-party provider. The context makes it somewhat less dangerous than arbitrary exfiltration because it is functionally related to the skill, but it still expands disclosure scope beyond what many users may expect.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

Generate a clean spoken version of the brand name — useful for overlaying on the instrumental:

bash

curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This TTS endpoint is a real external transmission of user-derived brand data to a third-party provider. The context makes it somewhat less dangerous than arbitrary exfiltration because it is functionally related to the skill, but it still expands disclosure scope beyond what many users may expect.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

Generate a clean spoken version of the brand name — useful for overlaying on the instrumental:

bash

curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \
  -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and introductory description scope the skill to creating a 5–15 second branded musical piece. However, Step 5 adds a distinct text-to-speech capability to synthesize a spoken brand-name clip and the output section presents it as a third deliverable, which goes beyond just generating a jingle.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A brand-jingle generator would be expected to call music and lyric generation APIs, but generating a separate spoken brand-name file is an additional audio-production feature. The manifest does not describe voice synthesis, narration, or spoken overlays as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill instructs fixed voice selection based on tone keywords and uses preset IDs in a workflow otherwise centered on Chinese-language content, but it does not tell the user they can choose another language or locale. This creates an implicit locale preference without opt-in or justification.

Content

No source excerpt is available for this finding.