Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

music generate

v1.0.0

Music composition assistant. Accepts natural language input, guides the user through multi-turn interaction to define genre, mood, theme, tempo, and other mu...

0· 81·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for gentleyo/music-generate.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "music generate" (gentleyo/music-generate) from ClawHub.
Skill page: https://clawhub.ai/gentleyo/music-generate
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install music-generate

ClawHub CLI

Package manager switcher

npx clawhub@latest install music-generate
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (music composition assistant that builds prompts for Suno/Udio and saves output) matches the SKILL.md content. The steps (multi-turn elicitation, prompt generation, instructions for using web UI or local API wrappers, and saving files) are coherent with the stated purpose.
!
Instruction Scope
The SKILL.md includes executable guidance and a Python snippet that reads SUNO_API_URL from the environment and downloads audio URLs, but the skill metadata declared no required env vars. The instructions also advise storing account session credentials in a local .env file and using community API wrappers — this directs the user/agent to handle credentials and to write files to user-specified paths (which could be any filesystem location). The code downloads content from arbitrary URLs returned by the API and writes it to disk without extra validation. These behaviors are plausible for the feature but expand scope (credential handling, filesystem writes, network fetches) beyond what the metadata advertises.
Install Mechanism
No install spec or code files are present; the skill is instruction-only. That minimizes disk footprint and installation risk.
!
Credentials
The metadata lists no required environment variables, yet the runtime instructions and sample code require SUNO_API_URL and discuss storing session credentials in a .env. Asking users to supply account session credentials (for community wrappers) is sensitive and should be declared explicitly. The skill's declared surface does not justify or disclose this credential handling.
Persistence & Privilege
The skill is not always-enabled and does not request persistent privileges or make changes to other skills or global agent configuration. Autonomous invocation is allowed (platform default) but is not combined with other high-privilege requests.
What to consider before installing
This skill appears to do what it says (help craft prompts and save generated music), but the instructions ask you to configure a local API endpoint (SUNO_API_URL) and to use community wrappers that require session credentials — none of which are declared in the skill metadata. Before installing or using this skill: - Prefer the web interface option (paste prompts into Suno/Udio web apps) if you don't want to share credentials or run local wrappers. - If you run a community wrapper, inspect its source, run it locally in a sandbox, and avoid pointing SUNO_API_URL at a remote server you don't control. - Do not store session cookies or account credentials in places that could be checked into source control; use a secure secrets mechanism. - Be cautious when choosing the output save path — avoid system or sensitive directories. - Ask the skill author to declare required environment variables (e.g., SUNO_API_URL) and to explain exactly what credentials are needed and why; a coherent metadata declaration would increase trust. Given the undeclared credential and environment usage, treat this skill as suspicious until these clarifications are provided.

Like a lobster shell, security has layers — review code before you run it.

latestvk9701q35mmqy73kfta9ypzj1gh84m2hw
81downloads
0stars
1versions
Updated 2w ago
v1.0.0
MIT-0

Music Composer

This skill helps users go from a single natural language description to a finished music file, through a structured multi-turn conversation.

When to Use

Trigger this skill when the user:

  • Says "create a song", "generate some music", "I want a track that..."
  • Describes a mood, scene, or use case (e.g. "something for working out", "a sad piano piece")
  • Wants to use Suno or Udio but doesn't know how to write a prompt

Workflow

Step 1: Understand Intent

Parse the user's initial input. Extract any elements already mentioned, identify what's missing.

Core music elements:

ElementDescriptionExamples
GenreStyle of musicPop, Jazz, Lo-fi, Classical, EDM, Folk
MoodEmotional toneUpbeat, melancholic, energetic, calm, mysterious
ThemeSubject or sceneHeartbreak, travel, morning, city at night
TempoSpeedSlow 60bpm / Medium 120bpm / Fast 160bpm
InstrumentsMain soundsPiano, guitar, synth, strings, drum machine
DurationTarget length30s / 1 minute / full song (3-4 min)
VocalsVoice presenceInstrumental / male / female / choir
LanguageLyric language (if vocals)English / Chinese / no lyrics

Step 2: Multi-Turn Interaction

Ask about missing elements in batches — max 2-3 questions per round. Wait for the user's reply before moving to the next round.

Interaction rules:

  • Offer 3-4 labeled options per element, plus a "custom" option
  • If the user says "up to you" or "whatever", pick recommended defaults and move on
  • Keep the tone conversational and light

Round 1 — Genre + Mood:

Got it! Let me help you build this track. A couple of quick questions:

1. Genre preference?
   A. Lo-fi Hip-hop (relaxed, study vibes)
   B. Pop (catchy, accessible)
   C. EDM (high energy, driving beat)
   D. Classical / Neo-classical (instrumental, refined)
   E. Custom: ___

2. Overall mood?
   A. Upbeat and happy
   B. Melancholic
   C. Motivating / energetic
   D. Calm and meditative

Round 2 — Tempo + Instruments:

Got it! Two more:

1. Tempo?
   A. Slow (60-80 BPM — relaxing, sleep)
   B. Medium (90-120 BPM — everyday background)
   C. Fast (130-160 BPM — workout, focus)

2. Main instruments? (pick multiple)
   Piano / Guitar / Synth / Strings / Drum machine / Bass / Custom

Round 3 — Vocals + Duration + Output path:

Almost there:

1. Vocals?
   A. Instrumental only
   B. Female vocals
   C. Male vocals

2. Duration?
   A. Short clip (30s)
   B. 1 minute
   C. Full track (3-4 min)

3. Where should the file be saved? (enter a folder path)

Step 3: Generate Prompt Options

Once all elements are collected, present 2-3 style variants for the user to choose from. Each variant includes:

  • A name and style description
  • A complete English prompt ready for Suno or Udio

Format:

Option A — "Midnight Drive"
Style: Dark, cinematic lo-fi with a slow groove

Prompt:
lo-fi hip hop, melancholic, late night city drive, slow tempo 75bpm,
piano melody, vinyl crackle, soft drums, bass guitar,
instrumental, 2 minutes, atmospheric, nostalgic

Option B — "Neon Glow" (City Pop flavor)
Style: 80s-inspired City Pop, warm synths, nostalgic

Prompt:
city pop, 1980s inspired, nostalgic, upbeat 110bpm,
electric piano, synthesizer, bass, light drums,
instrumental, dreamy, 3 minutes

Step 4: API Setup Guidance

Before generating, check whether the user has API access configured. If not, explain the options:

Option 1: Web interface (no setup required)

The easiest way — paste the prompt directly into the web app:
- Suno: https://suno.com
- Udio: https://www.udio.com

Download the result manually and save it to your chosen folder.

Option 2: Self-hosted API (automated)

Suno and Udio do not have official public APIs.
Community-maintained wrappers are available on GitHub:
- Suno: https://github.com/gcui-art/suno-api
- Udio: https://github.com/udioapi/udio-api

These require your account session credentials.
Store credentials in a local .env file — never hardcode them in scripts.
Refer to each project's README for setup instructions.

Step 5: Generate and Save

Once the user confirms a prompt and has API access ready, run the generation script:

import requests
import os

def generate_music(prompt: str, output_path: str):
    """
    Call the local Suno API and save the result to output_path.
    Requires SUNO_API_URL set in environment (e.g. http://localhost:3000).
    Credentials must be configured in the API service, not passed here.
    """
    api_url = os.getenv("SUNO_API_URL")
    if not api_url:
        raise EnvironmentError("SUNO_API_URL is not set in environment variables.")

    response = requests.post(f"{api_url}/api/generate", json={
        "prompt": prompt,
        "make_instrumental": True,
        "wait_audio": True
    })

    if response.status_code != 200:
        raise RuntimeError(f"API request failed: {response.status_code}")

    data = response.json()

    os.makedirs(output_path, exist_ok=True)
    saved = []
    for i, item in enumerate(data):
        audio_url = item.get("audio_url")
        if audio_url:
            audio_data = requests.get(audio_url).content
            filepath = os.path.join(output_path, f"track_{i+1}.mp3")
            with open(filepath, "wb") as f:
                f.write(audio_data)
            saved.append(filepath)

    return saved

After generation, report to the user:

Music saved to: [output path]/track_1.mp3

Details:
- Duration: ~3 minutes
- Format: MP3
- Prompt used: [prompt text]

Want to regenerate or adjust the style?

Notes

  • Music generated via Suno/Udio is subject to each platform's terms of service — verify before commercial use
  • Community API wrappers may break when platforms update — check the respective GitHub repos for status
  • If the API is unavailable, output the full prompt so the user can generate manually via the web interface
  • The output directory will be created automatically if it does not exist

Comments

Loading comments...