T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.js:3- Finding
Unvalidated API Base Override Can Exfiltrate API Credentials and Music Prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Music
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but an undocumented endpoint override can send the user's MakebestMusic API key and prompts to an arbitrary server if the runtime environment is influenced.
Review this skill before installing. It needs a MakebestMusic key and will send your music prompts to the service. Only use it in an environment where other tools or workspace configuration cannot set MBM_API_BASE, or ask the publisher to remove or validate that override so credentials are sent only to the official HTTPS MakebestMusic API.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/query.js:3- Finding
Unvalidated Status API Destination Can Exfiltrate API Credentials and Music Identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to execute local Node.js scripts that use an API key and make outbound network requests, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization and review gap: the skill appears less privileged than it really is, making it easier to run code and access secrets without clear operator awareness or policy enforcement.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 66% confidence
- Finding
The skill explicitly supports asynchronous generation and later status checks ('How's my song going?'), which implies persistence of external task identifiers across turns. If session/task state is not clearly scoped to the initiating user or conversation, another user or session could query or surface someone else's generation results, causing cross-session data leakage.
- Content
md --- name: text-to-music description: AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creators, musicians, and anyone wanting custom AI music. Triggers on requests like "create a song", "generate music", "makebestmusic", "AI music", "write a melody", etc. version: 1.2.0 metadata: openclaw:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and include common requests like 'create a song' and 'generate music,' which can cause the skill to activate in loosely related contexts. Over-broad invocation increases the chance that the agent will unnecessarily run code, use the configured API key, or send user content to a third-party service when the user did not clearly intend to use this integration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The setup instructions direct users to "MBM官网", introducing Chinese-language guidance in an otherwise English skill without stating that the skill is China-specific or giving users a language/locale option. This can violate language/locale policy expectations when a skill implicitly assumes a specific language context without opt-in.
- Content