ClawHub

Text to Song

v1.0.0

AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator...

⭐ 0· 110·0 current·0 all-time
byMakeBestMusic@sthk-mbm·duplicate of @sthk-mbm/texttomusic
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description advertise MakebestMusic music generation and the included scripts call makebestmusic API endpoints and require a single apiKey credential — this is coherent and expected.
✓
Instruction Scope
SKILL.md instructs the agent to run the bundled node scripts which only (a) read the apiKey env var, (b) optionally read MBM_API_BASE if set, and (c) POST/GET to makebestmusic endpoints. The instructions do not ask the agent to read unrelated files, other credentials, or transmit data to unexpected endpoints.
✓
Install Mechanism
No install step or remote downloads. The skill is instruction-only with two local JS scripts that are executed by node; nothing is pulled from untrusted URLs or written during install.
ℹ
Credentials
The skill only requires a single apiKey (declared as primaryEnv) which matches the code usage. One optional env var (MBM_API_BASE) is referenced by the scripts but not declared in requires.env — harmless but note that if an operator sets MBM_API_BASE it will redirect API calls to a custom endpoint.
✓
Persistence & Privilege
always is false, the skill does not request permanent/force-loaded access or attempt to modify other skills or system-wide configs in the provided files/instructions.
Assessment
This skill appears to be what it claims: it needs a MakebestMusic apiKey and runs the included node scripts to call MakebestMusic APIs. Before installing: (1) Only provide an apiKey you obtained from makebestmusic.com and avoid reusing high-privilege or unrelated keys. (2) Be aware the scripts honor an optional MBM_API_BASE environment variable — don't set that to an unknown host or it could redirect API traffic. (3) Review the MakebestMusic account settings and rotate/delete the key if you later stop using the skill. (4) If you have strict security requirements, run the scripts in a sandboxed environment or inspect network traffic to confirm calls go to makebestmusic.com.
✗
scripts/generate.js:3
Environment variable access combined with network send.
✗
scripts/query.js:3
Environment variable access combined with network send.
Confirmed safe by external scanners
Static analysis detected API credential-access patterns, but both VirusTotal and OpenClaw confirmed this skill is safe. These patterns are common in legitimate API integration skills.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f9wbdmpdjy5nfgn42g770y5833me4

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
EnvapiKey
Primary envapiKey

Comments