Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward SenseAudio API documentation skill; it sends user-provided music prompts and lyrics to the disclosed SenseAudio service when used.
Install only if you intend to send music prompts, lyrics, titles, style choices, and related generation metadata to SenseAudio's external API. Keep SENSEAUDIO_API_KEY in an environment variable or secret manager, do not paste real keys into shared logs or code, and avoid submitting confidential or regulated text unless you have approved SenseAudio's data handling terms.
The skill clearly instructs users to send prompts and lyrics to a third-party service, but it does not prominently warn that potentially sensitive user content will leave the local environment and be processed externally. This creates a privacy and data-handling risk because users may unknowingly submit confidential or regulated text to the vendor.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Response (async): Returns task_id — poll with lyrics pending endpoint.
curl -X POST https://api.senseaudio.cn/v1/song/lyrics/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt": "一段慷慨激昂的歌词", "provider": "sensesong"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Response (async): Returns task_id — poll with lyrics pending endpoint.
curl -X POST https://api.senseaudio.cn/v1/song/lyrics/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt": "一段慷慨激昂的歌词", "provider": "sensesong"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Response (async): Returns task_id — poll with lyrics pending endpoint.
curl -X POST https://api.senseaudio.cn/v1/song/lyrics/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt": "一段慷慨激昂的歌词", "provider": "sensesong"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Response (async): Returns task_id — poll with lyrics pending endpoint.
curl -X POST https://api.senseaudio.cn/v1/song/lyrics/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt": "一段慷慨激昂的歌词", "provider": "sensesong"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Response (async): Returns task_id — poll with lyrics pending endpoint.
curl -X POST https://api.senseaudio.cn/v1/song/lyrics/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{"prompt": "一段慷慨激昂的歌词", "provider": "sensesong"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
```bash
curl -X POST https://api.senseaudio.cn/v1/song/music/create \
-H "Authorization: Bearer $SENSEAUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
BASE = "https://api.senseaudio.cn"
# Step 1: Generate lyrics
resp = requests.post(f"{BASE}/v1/song/lyrics/create",
headers=HEADERS,
json={"prompt": "一首关于夏天的流行歌曲", "provider": "sensesong"})
lyrics_data = resp.json()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
BASE = "https://api.senseaudio.cn"
# Step 1: Generate lyrics
resp = requests.post(f"{BASE}/v1/song/lyrics/create",
headers=HEADERS,
json={"prompt": "一首关于夏天的流行歌曲", "provider": "sensesong"})
lyrics_data = resp.json()
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
lyrics_text = lyrics_data["data"][0]["text"]
# Step 2: Generate song
resp = requests.post(f"{BASE}/v1/song/music/create",
headers=HEADERS,
json={"model": "sensesong", "lyrics": lyrics_text, "style": "pop", "vocal_gender": "f"})
task_id = resp.json()["task_id"]
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
lyrics_text = lyrics_data["data"][0]["text"]
# Step 2: Generate song
resp = requests.post(f"{BASE}/v1/song/music/create",
headers=HEADERS,
json={"model": "sensesong", "lyrics": lyrics_text, "style": "pop", "vocal_gender": "f"})
task_id = resp.json()["task_id"]
The documentation references a bearer API key and includes examples using it, but does not warn users to protect the secret from shell history, screenshots, logs, or pasted examples. While the sample uses an environment variable rather than a hardcoded real key, the omission still increases the chance of credential exposure through unsafe handling.
No suspicious patterns detected.