Text to Music

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This music-generation skill mostly matches its stated purpose, but it has under-disclosed credential and command-execution risks that users should review before installing.

Install only if you are comfortable giving this skill a MakebestMusic API key and having prompts and generated music IDs sent to MakebestMusic. Avoid running it in an environment where MBM_API_BASE can be set by untrusted code, and prefer a version that fixes the API host to the official HTTPS endpoint and invokes scripts with structured arguments rather than shell interpolation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:3

Finding

Unvalidated API endpoint override can disclose credentials during music generation

Content

View full analysis

` and the user’s music prompt. 5. The attacker’s server records the credential and request body. 6. The attacker may reuse the stolen credential ...[truncated 599 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query.js:3

Finding

Unvalidated API endpoint override can disclose credentials during status queries

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:89

Finding

User-controlled music prompt is documented for unsafe shell interpolation

Content

View full analysis

" ``` ``` ### Technical Analysis The documentation instructs the Agent to substitute a user-controlled music description directly into a shell command. Wrapping the value in double quotes is not sufficient shell escaping: command substitutions such as `$(...)` and backticks remain active inside double-quoted strings, while embedded quote characters can terminate or restructure the intended argument. The JavaScript program itself consumes `process.argv` and does not need shell parsing. The vulnerability arises at the documented invocation boundary if the Agent or runtime constructs and executes the displayed command through a shell. A structured process invocation with an argument array would provide the required functionality without allowing the shell to interpret the prompt. ### Attack Path 1. A user supplies a music description containing shell metacharacters or command-substitution syntax. 2. The Agent substitutes that description for `` in the documented command. 3. The resulting string is executed by a shell. 4. The shell evaluates the injected syntax before starting Node. 5. The injected command runs with the operating-system permissions and environment of the Agent process. 6. The legitimate generation script may then run normally, making the additional command execution less apparent. Exploitation depends on the runner following the documentation by constructing a shell command rather than passing arguments through a non-shell process API. ### Impact Assessment Successful exploitation can execute arbitrary local commands with the Skill runner’s privileges. Depending on the runtime’s permissions, this could permit: - Reading files accessible to the A ...[truncated 350 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to execute local Node.js scripts and use an API key/network access, but it does not declare an explicit tool scope such as allowed tools or permissions. That creates a gap between documented behavior and enforceable policy, increasing the risk of unintended command execution or broader-than-necessary access if the runtime permits defaults.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: text-to-music
description: AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creators, musicians, and anyone wanting custom AI music. Triggers on requests like "create a song", "generate music", "makebestmusic", "AI music", "write a melody", etc.
version: 1.2.0
metadata:
  openclaw:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is broad enough to match common phrases like 'generate music' or 'create a song' without tighter constraints, which can cause the skill to activate in contexts the user did not intend. Over-broad activation can expose the API key, invoke networked code unexpectedly, or interfere with other safer/more appropriate skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The setup instructions direct users to "MBM官网" while the rest of the document is in English, but the skill does not state that it is China-specific or offer an alternative language/localization path. This can amount to an implicit language preference without user opt-in or justification.

Content

No source excerpt is available for this finding.