ClawHub
Back to skill

Security audit

Lyric Flip

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only lyric and song generation workflow that openly uses the SenseAudio API and shows no hidden installation, persistence, or unrelated access.

Install only if you are comfortable sending lyric prompts, structure details, approved lyrics, style choices, and song-generation parameters to SenseAudio using your API key. Avoid private, confidential, or copyrighted material you are not allowed to share, and review the generated prompt before API submission.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill manifest and description present the capability as lyric rewriting, but the documented workflow additionally generates full music and returns audio assets. This is a meaningful scope expansion because it causes the agent to send approved lyrics and style metadata to a third-party music-generation API, creating hidden external actions and data handling beyond the stated purpose.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
Full music generation is not justified by the stated function of preserving lyrical structure during rewrites. This expands the skill from text transformation into media creation, increasing external transmission, cost exposure, and the chance of surprising users with actions they did not request or authorize.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The workflow sends user-provided lyrical content and derived prompts to an external API without a clear user-facing warning or consent step. Because reference lyrics may contain copyrighted, proprietary, or sensitive text, undisclosed transmission creates privacy, compliance, and trust risks.

Missing User Warnings

Low
Confidence
85% confidence
Finding
The skill requires an external API credential and third-party service access but does not prominently warn users that their request may involve external processing. While the credential itself is not exposed in the document, the absence of a user-facing notice weakens informed consent around remote service use.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal