Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Ai Music

v1.0.1

AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator...

0· 331·0 current·0 all-time
byMakeBestMusic@sthk-mbm·duplicate of @sthk-mbm/texttomusic

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sthk-mbm/ai-music.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Ai Music" (sthk-mbm/ai-music) from ClawHub.
Skill page: https://clawhub.ai/sthk-mbm/ai-music
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required env vars: apiKey
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install ai-music

ClawHub CLI

Package manager switcher

npx clawhub@latest install ai-music
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, SKILL.md, and the two scripts all target MakebestMusic's API and only require a single apiKey credential — this matches the stated purpose of generating music.
Instruction Scope
Runtime instructions only run the included node scripts and return or show status/links from the MakebestMusic API. The scripts do not read unrelated files or attempt to transmit data to other services beyond the configured API endpoint.
Install Mechanism
No install spec; skill is instruction-only with small JS scripts. No downloads or archive extraction are performed by the skill itself — low installation risk.
Credentials
The skill declares a single required credential (apiKey), which is appropriate. One minor point: both scripts optionally read MBM_API_BASE from the environment to override the API base URL, but MBM_API_BASE is not listed in the declared requirements. This override is commonly used for testing but could be misused if an environment variable were maliciously set to redirect requests to an attacker-controlled endpoint; consider ensuring MBM_API_BASE is not set to an untrusted host.
Persistence & Privilege
The skill is not always-enabled, is user-invocable, and does not request system-wide configuration changes or access to other skills' credentials.
Assessment
This skill appears to do what it claims: it sends prompts and your apiKey to MakebestMusic and reports back status/links. Before installing: 1) Confirm you trust makebestmusic.com and the key you generate (review their privacy/tos if needed). 2) Treat the apiKey like a secret — only grant it to this skill and consider whether the provider lets you scope or rotate keys. 3) Ensure no untrusted MBM_API_BASE environment variable is set on your system (it can redirect requests to another host). 4) If you need higher assurance, inspect the scripts yourself or run them in an isolated environment to observe network calls.
scripts/generate.js:3
Environment variable access combined with network send.
scripts/query.js:3
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🎵 Clawdis
EnvapiKey
Primary envapiKey
latestvk9783c3f1sg8h4nkdh868802c1833sg2
331downloads
0stars
2versions
Updated 10h ago
v1.0.1
MIT-0

🎵 AI Music Studio

✨ Describe your vision, let AI compose the melody ✨


🚀 Get Your API Key

  1. Visit 👉 MBM官网 and sign up 📝
  2. Go to My Account → Claw key 🔑
  3. Click Create Key and copy it ✂️
  4. ⚠️ Important: Save your key immediately — it won't be shown again!

⚙️ Configure Your Key

  1. Open OpenClaw app 📱
  2. Click Skills in the left menu 📋
  3. Find text-to-music 🎶
  4. Click Configure or Environment Variables
  5. Enter your Claw key (xxx...) in the apiKey field 🔐
  6. Save — you're ready to go! 🎉
  7. Restart openclaw

💫 How It Works

Just tell me what kind of song you want! For example:

  • "Create a happy pop song about summer"
  • "Generate an upbeat K-pop dance track"
  • "Make a relaxing piano piece for studying"

Instrumental or Vocals?

  • If you want vocals (song with singing): just describe your song
  • If you want pure music (no singing): include words like "instrumental", "pure music", or "no vocals" in your request

What to include in your description:

  • 🎼 Genre: Pop, Electronic, Classical, Rock, Jazz, R&B, Hip-hop, K-pop, Chinese-style
  • 😊 Mood: Happy, Sad, Romantic, Energetic, Calm, Exciting
  • 💖 Theme: Love, Dreams, Nature, Night, Adventure
  • 🎸 Instruments: Piano, Guitar, Drums, Synth, Strings

I'll default to vocals if you don't specify!


💬 Example Requests

With Vocals (Default)

  • "Create a happy pop song about summer with synth and guitar"
  • "Generate an upbeat K-pop dance track about love"
  • "Write a romantic R&B song about heartbreak"
  • "Make an energetic electronic song for a workout"

Instrumental

  • "Create an instrumental piano piece for studying"
  • "Generate a relaxing ambient track, no vocals"
  • "Make a pure music classical piano piece"

Check Status

  • "How's my song going?"
  • "Is my song ready?"

🎵 Generating a Song

When user requests a song:

  1. If user provides description: Use their description, default to vocals (false) unless they explicitly say "instrumental" or "pure music"
  2. If user says "create a song" or "generate music" without description: Ask them what kind of song they want

Then run:

node ~/.openclaw/workspace/skills/text-to-music/scripts/generate.js "<prompt>" <instrumental>

Parameters:

  • <prompt>: Song description
  • <instrumental>: "true" for instrumental/pure music, "false" for vocals

Returns:

{
 "success": true,
 "music_ids": ["abc123", "def456"],
 "status": "pending",
 "message": "Music generation started!"
}

🔍 Query Task Status

Check generation status:

node ~/.openclaw/workspace/skills/text-to-music/scripts/query.js "<music_id_1> <music_id_2> ..."

Returns (completed):

[
 {
 "music_id": "abc123",
 "status": "completed",
 "url": "https://makebestmusic.com/app/shared-music/abc123"
 }
]

Returns (processing):

[
 {
 "music_id": "abc123",
 "status": "pending"
 }
]

Status handling:

  • completed: Present with celebration! Show title, duration (if available), and clickable link
  • pending: Tell user it's still processing, suggest they ask again later
  • failed: Explain failure, suggest retrying with different description

⏱️ Generation Time

  • ⏱️ Typical time: 2-3 minutes
  • 💡 Ask "How's my song going?" to check the status

❓ Troubleshooting

Q: "API Key invalid" error?

Make sure the key is copied completely (includes "sk-" prefix). No extra spaces. Try generating a new key if issues persist.

Q: How long does it take?

Usually 2-3 minutes. Ask me "How's my song going?" to check!

Q: What if generation fails?

Try a simpler description. Avoid special characters. Try again with different keywords.

Comments

Loading comments...