Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Byted Music Generate

v1.0.0

Generate music using Volcengine Imagination API. Supports vocal songs, instrumental BGM, and lyrics generation. Use when the user wants to create songs, back...

0· 106·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for volcengine-skills/byted-music-generate.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Byted Music Generate" (volcengine-skills/byted-music-generate) from ClawHub.
Skill page: https://clawhub.ai/volcengine-skills/byted-music-generate
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install byted-music-generate

ClawHub CLI

Package manager switcher

npx clawhub@latest install byted-music-generate
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description indicate Volcengine music generation and the code and docs implement HMAC-authenticated calls to Volcengine Imagination API — the requested capability matches the stated purpose. However, the registry metadata lists no required environment variables or primary credential while SKILL.md and scripts require VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY (incoherent metadata).
Instruction Scope
SKILL.md instructs running the included Python script and monitoring its stdout/stderr while it polls the provider. The runtime instructions and code are scoped to submitting tasks and polling results from Volcengine; they do not instruct reading unrelated files or exfiltrating data. The doc's requirement to 'periodically (every 10 seconds) read the terminal output' is operationally odd but not malicious.
Install Mechanism
There is no external install spec or remote download. The bundle contains a Python script and a simple requirements.txt (requests). No obscure installers or external URLs are fetched at install time, so installation risk is low.
!
Credentials
The only secrets used by the script are VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY which are proportionate to calling Volcengine APIs. The concern is that the registry metadata declared no required env vars/credentials while both SKILL.md and the script require AK/SK — this mismatch could lead users to miss the need to provide credentials or to provide them without noticing. Also note supplying AK/SK grants API/billing access to your Volcengine account.
Persistence & Privilege
The skill does not request always:true, does not persist changes to other skills or system config, and does not create background services. It runs as an invoked script and does network calls to Volcengine only.
Scan Findings in Context
[no_findings] expected: Static pre-scan reported no injection signals. This is expected for straightforward Python code that performs HMAC-signed HTTP requests to the official Volcengine API host.
What to consider before installing
This skill implements Volcengine music generation and requires your Volcengine AccessKey (VOLCENGINE_ACCESS_KEY) and SecretKey (VOLCENGINE_SECRET_KEY). Before installing: (1) confirm the skill source and trustworthiness (registry metadata omitted the required credentials; ask the publisher to correct this); (2) use a dedicated, minimum-privilege API key (or an account with limited billing) rather than your primary account key; (3) be aware the script will submit tasks that may incur charges (billing modes exist); (4) inspect or run the included Python script in a sandboxed environment if you want to verify behavior yourself — the code appears to only call open.volcengineapi.com, sign requests with HMAC, poll task status, and return audio URLs. If you do not trust the publisher or cannot confirm the origin, do not provide your AK/SK.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ds106mk8p8wqxxs14hwxsc983n9h8
106downloads
0stars
1versions
Updated 1mo ago
v1.0.0
MIT-0

Music Generate Skill

This skill generates music using the Volcengine Music Generation API. It supports vocal songs, instrumental BGM, and AI lyrics generation.

Trigger Conditions

  1. User wants to generate a song (with lyrics or a text prompt)
  2. User needs background music, instrumental tracks, or soundtracks
  3. User wants AI-generated lyrics
  4. User mentions "write a song", "music generation", "BGM", "background music", "lyrics"

Environment Variables

Before using this skill, ensure the following environment variables are set:

  • VOLCENGINE_ACCESS_KEY — AccessKey ID
  • VOLCENGINE_SECRET_KEY — AccessKey Secret

How to obtain: Volcengine Console → Account (top-right) → Key Management → Create Key.

Usage

  1. Determine user intent and select the mode (song / bgm / lyrics).
  2. cd to the skill directory: skills/byted-music-generate.
  3. Run the script. The script polls the API internally and may take several minutes to complete (typically 1–5 minutes for song/bgm).
  4. Monitor execution: If the runtime environment moves the command to background, you MUST periodically (every 10 seconds) read the terminal output to check whether the script has finished. The script prints polling progress to stderr and outputs a single JSON line to stdout upon completion.
  5. Once completed, return the audio_url or lyrics from the JSON output to the user.

Three Modes

1. song — Vocal Song

User provides lyrics (Lyrics) or a text prompt (Prompt) to generate a vocal song.

# With text prompt
python scripts/music_generate.py song --prompt "A song about summer at the beach" --genre Pop --gender Female

# With lyrics
python scripts/music_generate.py song --lyrics "[verse]\nMoonlight on the windowsill\nMemories flowing like water\n[chorus]\nYou are my moonlight" --genre Folk --mood "Sentimental/Melancholic/Lonely"

Note: --lyrics and --prompt are mutually exclusive; lyrics takes priority. If the user hasn't provided lyrics, you can first use the lyrics mode to generate them, then pass the result to the song mode.

2. bgm — Instrumental BGM

Describe the desired music in natural language. The v5.0 model does not require Genre/Mood parameters — just describe everything in the --text field.

python scripts/music_generate.py bgm --text "Relaxed coffee shop ambiance music with piano and guitar" --duration 60

# With song structure segments
python scripts/music_generate.py bgm --text "Epic game soundtrack" --segments '[{"Name":"intro","Duration":10},{"Name":"chorus","Duration":30}]'

3. lyrics — Lyrics Generation

Returns synchronously (no polling needed). Can be used standalone or as a pre-step for the song mode.

python scripts/music_generate.py lyrics --prompt "A song about graduation farewell" --genre Folk --mood "Sentimental/Melancholic/Lonely" --gender Female

Manual Task Query (timeout fallback)

python scripts/music_generate.py query --task-id "202601397834584670076931"

Mode Detection Logic

User Request
    ↓
Contains "instrumental/BGM/background music/soundtrack"?
    ├─ Yes → bgm mode
    └─ No → Contains "lyrics/write lyrics" and does NOT request audio?
        ├─ Yes → lyrics mode
        └─ No → song mode
            ├─ User provided lyrics → --lyrics
            └─ User only described a theme → --prompt (or lyrics first, then song)

Script Parameters

song mode

ParameterRequiredDescription
--lyricseitherLyrics with structure tags
--prompteitherText prompt (Chinese, 5-700 chars)
--model-versionnov4.0 or v4.3 (default: v4.3)
--genrenoMusic genre
--moodnoMusic mood
--gendernoFemale / Male
--timbrenoVocal timbre
--durationnoDuration in seconds [30-240]
--keynoMusical key (v4.3 only)
--kmodenoMajor / Minor (v4.3 only)
--temponoTempo (v4.3 only)
--instrumentnoInstruments, comma-separated (v4.3 only)
--genre-extranoSecondary genres, comma-separated, max 2 (v4.3 only)
--scenenoScene tags, comma-separated (v4.3 only)
--langnoLanguage (v4.3 only)
--vod-formatnowav / mp3 (v4.3 only)
--billingnoprepaid / postpaid (default: postpaid)
--timeoutnoMax wait seconds (default: 300)

bgm mode

ParameterRequiredDescription
--textyesNatural language description
--durationnoDuration in seconds [30-120]
--segmentsnoJSON array of song structure segments
--versionnoModel version (default: v5.0)
--enable-input-rewritenoEnable prompt rewriting
--billingnoprepaid / postpaid (default: postpaid)
--timeoutnoMax wait seconds (default: 300)

lyrics mode

ParameterRequiredDescription
--promptyesLyrics prompt (Chinese only, <500 chars)
--genrenoMusic genre
--moodnoMusic mood
--gendernoFemale / Male

Script Return Info

The script outputs JSON with the following fields:

{
    "status": "success | timeout | error",
    "mode": "song | bgm | lyrics | query",
    "task_id": "...",
    "audio_url": "https://...",
    "duration": 46.0,
    "lyrics": "...",
    "error": null
}

Return the audio_url to the user for download or playback. URLs are valid for approximately 1 year, but users should save the file promptly.

Error Handling

  • PermissionError: VOLCENGINE_ACCESS_KEY ...: Inform the user to configure the environment variables. Write them to the workspace environment variable file, then retry.
  • status: "timeout": The task is still generating. Provide the user with the task_id and the manual query command from the output.
  • Copyright check failure (code 50000001): Suggest the user enrich the description or increase the audio duration, then retry.

References

Comments

Loading comments...