T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.js:3- Finding
Configurable API endpoint can disclose the API credential and user prompts
- Content
View full analysis
- Remediation
View remediation
Security audit
Generate ai Music
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent music-generation integration, but its scripts can send the user's API key and prompts to an arbitrary endpoint if an environment variable is set.
Review this skill before installing. It appears intended to generate music through MakebestMusic, but only use it in an environment where MBM_API_BASE cannot be set or inherited from an untrusted source, avoid submitting confidential prompt text, and consider rotating the MakebestMusic key if it was ever used with a non-official endpoint.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/query.js:3- Finding
Configurable status endpoint can disclose the API credential and music task identifiers
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill invokes local Node.js scripts and requires environment and network capabilities, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can let the agent execute capabilities beyond what reviewers or users can easily assess, especially since requests are sent to an external service using a stored API key.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- name: text-to-music description: AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creators, musicians, and anyone wanting custom AI music. Triggers on requests like "create a song", "generate music", "makebestmusic", "AI music", "write a melody", etc. version: 1.2.0 metadata: openclaw:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include broad everyday requests like "create a song," "generate music," and "write a melody," which can cause unintended invocation in contexts where the user did not mean to call this external-service skill. Unintended activation can send user prompts to a third-party provider and consume the user's API-backed quota without clear consent at that moment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explains how to configure the API key and use the feature, but it does not clearly warn that prompts are transmitted to an external music-generation service using the user's API key. Users may unknowingly disclose sensitive or proprietary text in prompts, creating privacy and data-sharing risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script reads an API credential from an environment variable and only reports an error if it is missing, but it does not disclose to the user that the skill will access and use a secret for authentication. Under the code-file warning criteria, sensitive environment-variable access should have some visible warning, comment, or documented disclosure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The setup instructions direct users to "MBM官网," introducing a Chinese-language term in otherwise English instructions without indicating language options or whether localization is required. This can amount to an implicit locale assumption rather than giving users a clear language choice.
- Content