Text to Music

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This music-generation skill mostly matches its stated purpose, but it has under-disclosed credential and command-execution risks that users should review before installing.

Install only if you are comfortable giving this skill a MakebestMusic API key and having prompts and generated music IDs sent to MakebestMusic. Avoid running it in an environment where MBM_API_BASE can be set by untrusted code, and prefer a version that fixes the API host to the official HTTPS endpoint and invokes scripts with structured arguments rather than shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:3
• Finding: Unvalidated API endpoint override can disclose credentials during music generation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.js`, lines 3-37 **Vulnerability Type**: Unvalidated credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```js const API_BASE = process.env.MBM_API_BASE || "https://api.makebestmusic.com"; const API_KEY = process.env.apiKey; // ... const res = await fetch(`${API_BASE}/api/skill/generate_music`, { method: "POST", headers: { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}`, }, body: JSON.stringify({ model: "Fi", custom: true, instrumental: instrumental, prompt: prompt, title: "", style: "", advance: { vocal_gender: "", ai_lyrics: true } }), }); ``` ### Technical Analysis The script permits the API destination to be replaced through the undocumented `MBM_API_BASE` environment variable. It does not validate the URL scheme, hostname, port, or relationship to the official MakeBestMusic service. The same request sends the secret `apiKey` value as a bearer token. Consequently, any party capable of influencing the process environment can redirect the request to an arbitrary server and receive the credential. The override also permits a plaintext `http:` URL, which can expose the bearer token and prompt to network interception. Sending the API key and music prompt to the official MakeBestMusic HTTPS endpoint is necessary for the declared functionality. Allowing an unrestricted destination override exceeds that minimum requirement. ### Attack Path 1. An attacker, compromised launcher, unsafe configuration, or parent process sets `MBM_API_BASE` to an attacker-controlled URL. 2. The user requests music generation. 3. The Skill constructs the request using the attacker-controlled base URL. 4. The request includes `Authorization: Bearer <apiKey>` and the user’s music prompt. 5. The attacker’s server records the credential and request body. 6. The attacker may reuse the stolen credential ...[truncated 599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the runtime endpoint override and use a fixed official HTTPS origin: ```js const API_BASE = "https://api.makebestmusic.com"; ``` 2. If endpoint configurability is required for controlled testing, parse the value with `URL` and enforce: - The `https:` protocol. - An explicit hostname allowlist. - Approved ports only. - No embedded username or password. 3. Use separate test credentials for non-production endpoints. Never send production credentials to development or user-selected servers. 4. Document every environment variable that affects network destinations. 5. Apply strict execution-environment controls so untrusted users and unrelated Skills cannot modify this process’s environment. 6. Consider short-lived, narrowly scoped credentials and server-side revocation support to limit the impact of accidental disclosure. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query.js:3
• Finding: Unvalidated API endpoint override can disclose credentials during status queries<![CDATA[ ## Vulnerability Details **File Location**: `scripts/query.js`, lines 3-29 **Vulnerability Type**: Unvalidated credential-bearing network destination **Risk Level**: High ### Vulnerable Code ```js const API_BASE = process.env.MBM_API_BASE || "https://api.makebestmusic.com"; const API_KEY = process.env.apiKey; // ... const res = await fetch(`${API_BASE}/api/skill/music_status?${musicIdsParam}`, { headers: { Authorization: `Bearer ${API_KEY}`, }, }); ``` ### Technical Analysis The query script accepts an unrestricted endpoint from `MBM_API_BASE` and sends the MakeBestMusic API key to that endpoint in an authorization header. There is no validation that the destination is the official service or that TLS is used. The status request additionally includes generated music IDs in its query string. Redirecting the endpoint therefore exposes both the credential and identifiers associated with the user’s generation requests. Query parameters may also be retained in server, proxy, monitoring, or access logs. Sending these values to the official API is consistent with the declared status-checking function. Permitting arbitrary redirection is not necessary for that function and violates least-privilege network design. ### Attack Path 1. An attacker or compromised parent process sets `MBM_API_BASE` to an attacker-operated HTTP or HTTPS server. 2. The user or Agent checks the status of one or more generated tracks. 3. The script sends a request to the attacker-controlled destination. 4. The request contains the API key in the `Authorization` header and music IDs in the URL. 5. The attacker captures these values. 6. The attacker may reuse the credential within its assigned API scope and correlate or probe the disclosed music identifiers. ### Impact Assessment The vulnerability can expose: - The MakeBestMusic bearer credential. - Music-generation identifiers. - The fact and timing of status checks. The principal privilege obtained is the API autho ...[truncated 271 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the configurable base URL with the fixed official HTTPS endpoint. 2. If an override is operationally necessary, enforce an explicit HTTPS origin allowlist before attaching any authorization header. 3. Reject URLs that use plaintext HTTP, unapproved ports, embedded credentials, or unapproved hostnames. 4. Use separate, non-production credentials for test endpoints. 5. Where supported by the API, avoid placing sensitive identifiers in query strings; prefer an authenticated POST body or path design that minimizes logging exposure. 6. Ensure credentials are narrowly scoped, rotatable, and revocable. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89
• Finding: User-controlled music prompt is documented for unsafe shell interpolation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 89-95 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown Then run: ```bash node ~/.openclaw/workspace/skills/text-to-music/scripts/generate.js "<prompt>" <instrumental> ``` ``` ### Technical Analysis The documentation instructs the Agent to substitute a user-controlled music description directly into a shell command. Wrapping the value in double quotes is not sufficient shell escaping: command substitutions such as `$(...)` and backticks remain active inside double-quoted strings, while embedded quote characters can terminate or restructure the intended argument. The JavaScript program itself consumes `process.argv` and does not need shell parsing. The vulnerability arises at the documented invocation boundary if the Agent or runtime constructs and executes the displayed command through a shell. A structured process invocation with an argument array would provide the required functionality without allowing the shell to interpret the prompt. ### Attack Path 1. A user supplies a music description containing shell metacharacters or command-substitution syntax. 2. The Agent substitutes that description for `<prompt>` in the documented command. 3. The resulting string is executed by a shell. 4. The shell evaluates the injected syntax before starting Node. 5. The injected command runs with the operating-system permissions and environment of the Agent process. 6. The legitimate generation script may then run normally, making the additional command execution less apparent. Exploitation depends on the runner following the documentation by constructing a shell command rather than passing arguments through a non-shell process API. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the Skill runner’s privileges. Depending on the runtime’s permissions, this could permit: - Reading files accessible to the A ...[truncated 350 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not interpolate the prompt into a shell command. 2. Invoke Node through a structured process API with shell processing disabled: ```js spawn( process.execPath, [scriptPath, prompt, instrumental ? "true" : "false"], { shell: false } ); ``` 3. If the Skill framework supports structured tool arguments, document the invocation as an argument array rather than a command-line template. 4. If structured execution is unavailable, pass the prompt through standard input or a securely created data file rather than placing it in a shell command. 5. Treat shell escaping as a last resort. If unavoidable, use a well-tested escaping library appropriate to the exact target shell; do not rely on double quotes alone. 6. Add tests using prompts containing quotes, dollar signs, backticks, command substitutions, newlines, and other shell metacharacters to verify that every prompt is delivered as one literal argument. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill instructs the agent to execute local Node.js scripts and use an API key/network access, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates a gap between documented behavior and enforceable policy, increasing the risk of unintended command execution or broader-than-necessary access if the runtime permits defaults.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: text-to-music
description: AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creators, musicians, and anyone wanting custom AI music. Triggers on requests like "create a song", "generate music", "makebestmusic", "AI music", "write a melody", etc.
version: 1.2.0
metadata:
  openclaw:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger description is broad enough to match common phrases like 'generate music' or 'create a song' without tighter constraints, which can cause the skill to activate in contexts the user did not intend. Over-broad activation can expose the API key, invoke networked code unexpectedly, or interfere with other safer/more appropriate skills.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The setup instructions direct users to "MBM官网" while the rest of the document is in English, but the skill does not state that it is China-specific or offer an alternative language/localization path. This can amount to an implicit language preference without user opt-in or justification.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/generate.js:3

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/query.js:3