MusicGenerator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:24 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real MakebestMusic music-generation integration, but its scripts contain an undocumented endpoint override that could redirect the user's API key and prompts to another server if the environment is influenced.

Review this skill carefully before installing. It needs your MakebestMusic API key and will send your music prompts and task/status information to an external service. Do not use it with confidential lyrics, private project ideas, or sensitive text, and avoid running it in an environment where MBM_API_BASE could be set or changed by someone else.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:3

Finding

Unrestricted API Base Override Can Exfiltrate API Credentials During Music Generation

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.js, lines 3-4 and 21-34
Vulnerability Type: Unvalidated destination for authenticated network requests
Risk Level: High

Vulnerable Code

js

const API_BASE = process.env.MBM_API_BASE || "https://api.makebestmusic.com";
const API_KEY = process.env.apiKey;

js

const res = await fetch(`${API_BASE}/api/skill/generate_music`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${API_KEY}`,
  },
  body: JSON.stringify({
    model: "Fi",
    custom: true,
    instrumental: instrumental,
    prompt: prompt,
    title: "",
    style: "",
    advance: {
      vocal_gender: "",
      ai_lyrics: true
    }
  }),
});

Technical Analysis

The script permits the destination of an authenticated request to be replaced through the MBM_API_BASE environment variable. This variable is not documented as a required or supported configuration option in SKILL.md, and the code does not validate its scheme, hostname, port, or origin.

Under normal operation, sending the API key and music prompt to the declared MakeBestMusic HTTPS endpoint is necessary for the Skill's stated music-generation functionality. However, allowing an unrestricted endpoint override is not necessary for that functionality and violates least privilege. If an attacker or compromised launcher can influence the process environment, the bearer credential and user-supplied prompt will be sent to an attacker-controlled server.

This is a destination-validation flaw rather than proof of intentional exfiltration: the default destination is the documented MakeBestMusic service. Exploitation requires influence over the script's environment.

Attack Path

1. An attacker gains the ability to set or alter environment variables used when the Skill process starts.
2. The attacker sets MBM_API_BASE to an attacker ...[truncated 1057 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the MBM_API_BASE override from production code and use a fixed HTTPS origin:

   js

   const API_BASE = "https://api.makebestmusic.com";
   

2. If endpoint overrides are required for development or testing, enable them only under an explicit development mode.
3. Parse the configured URL with new URL() and enforce:
   • https: protocol.
   • An exact hostname allowlist.
   • Approved ports only.
   • No embedded credentials.
4. Reject configuration that does not match the approved MakeBestMusic origin before reading or transmitting the API key.
5. Use narrowly scoped and short-lived API credentials where supported.
6. Avoid placing unnecessary user data in outbound requests and clearly document what information is transmitted.
7. Add automated tests confirming that unapproved origins cannot receive authenticated requests.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query.js:3

Finding

Unrestricted API Base Override Can Exfiltrate API Credentials During Status Queries

Content

View full analysis

Vulnerability Details

File Location: scripts/query.js, lines 3-4 and 25-28
Vulnerability Type: Unvalidated destination for authenticated network requests
Risk Level: High

Vulnerable Code

js

const API_BASE = process.env.MBM_API_BASE || "https://api.makebestmusic.com";
const API_KEY = process.env.apiKey;

js

const res = await fetch(`${API_BASE}/api/skill/music_status?${musicIdsParam}`, {
  headers: {
    Authorization: `Bearer ${API_KEY}`,
  },
});

Technical Analysis

The status-query script accepts an arbitrary API origin from MBM_API_BASE and attaches the user's bearer API key to requests sent to that origin. The value is not constrained to HTTPS or to the documented MakeBestMusic hostname.

Sending the key and music identifiers to the legitimate MakeBestMusic API is required to query generation status. Permitting an undocumented, unrestricted replacement origin is not required and creates a credential-disclosure path when the execution environment can be influenced.

The music identifiers are URL-encoded, which prevents direct query-string injection through those values, but it does not mitigate the destination override. The default endpoint is legitimate; therefore, exploitation depends on an attacker being able to alter the environment rather than occurring during ordinary default execution.

Attack Path

1. An attacker obtains influence over the environment used to launch the Skill script.
2. The attacker sets MBM_API_BASE to a server under their control.
3. The user asks the Skill to check the status of generated music.
4. query.js sends a request to the attacker-controlled origin.
5. The request includes the MakeBestMusic bearer API key and the requested music IDs.
6. The attacker captures the key and identifiers and may reuse the credential according to its granted API permissions.

Impact Assessment

Successful exploitation can expose:

• The ...[truncated 561 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin production requests to the documented MakeBestMusic HTTPS origin rather than accepting an arbitrary environment-provided base URL.
2. If development overrides are essential, require an explicit non-production mode and validate the URL against a strict allowlist.
3. Require https: and reject unknown hostnames, nonstandard ports, embedded credentials, and malformed URLs.
4. Perform origin validation before adding the Authorization header.
5. Use scoped, revocable, and short-lived credentials where the service supports them.
6. Document every supported environment variable in SKILL.md; do not expose hidden security-sensitive configuration.
7. Add tests verifying that bearer credentials are never attached to requests targeting an unapproved origin.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to run local Node.js scripts and use an API key and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between documented behavior and enforceable runtime boundaries, increasing the risk of unintended code execution or broader-than-expected access if the platform does not constrain the skill automatically.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: text-to-music
description: AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creators, musicians, and anyone wanting custom AI music. Triggers on requests like "create a song", "generate music", "makebestmusic", "AI music", "write a melody", etc.
version: 1.2.0
metadata:
  openclaw:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad, including common requests like "create a song," "generate music," and "AI music," which can cause the skill to activate for ambiguous or unrelated user intents. Over-broad activation is dangerous here because invoking this skill may send user prompts to an external service and consume API-backed actions without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill does not clearly warn users that their prompts will be transmitted to an external third-party music-generation service. This is a real privacy and consent issue because users may include sensitive creative ideas or personal data in prompts without understanding that the content leaves the local agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code sends the user's music description and a bearer API key to a remote service, which is a safety-relevant network operation under the audit criteria. Although errors and success states are printed, there is no user-facing disclosure that input data will be transmitted to an external API, and no inline comment or docstring warning about that behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The setup instructions include Chinese text ("MBM官网") alongside English guidance, but the skill does not explain a language or locale requirement or provide a user-facing language choice. This can conflict with organizational language/locale expectations when a skill implicitly assumes mixed-language comprehension.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/generate.js:3

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/query.js:3