ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Text to Music

v1.0.0

AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator...

⭐ 0· 102·0 current·0 all-time
byMakeBestMusic@sthk-mbm
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description say 'MakebestMusic' generation and the scripts call api.makebestmusic.com endpoints using an apiKey. The single required environment variable (apiKey) matches the described need for a service API key.
✓
Instruction Scope
SKILL.md instructs the agent to run the included node scripts with a prompt and an instrumental flag; the scripts only read apiKey (and optionally MBM_API_BASE), send requests to the MakebestMusic API, and print JSON responses. The instructions do not ask the agent to read unrelated files, other credentials, or transmit data to unexpected endpoints.
✓
Install Mechanism
No install spec; this is instruction + small included scripts. There are no downloads, archive extracts, or external install steps that would write or execute arbitrary third-party code.
ℹ
Credentials
The only required env var declared is apiKey, which is appropriate. One minor inconsistency: the scripts also honor MBM_API_BASE (to override the API base URL) but MBM_API_BASE is not declared in requires.env or documented in SKILL.md. This is likely a convenience override but could be noted because it allows redirecting requests to a different host if set.
✓
Persistence & Privilege
The skill is not always-enabled and does not request persistent system-level privileges or modify other skills' configs. It runs when invoked and uses its own included scripts.
Assessment
This skill appears to do what it says: it sends your prompt (and optionally asks for vocals vs instrumental) to MakebestMusic using an apiKey you provide. Before installing: (1) Verify you trust Makebestmusic (the SKILL.md links to makebestmusic.com and includes an affiliate PID), since your prompts and any lyrics will be sent to that service; (2) Only set the apiKey environment variable for this skill and avoid providing other credentials; (3) Be aware the scripts support an MBM_API_BASE override (not documented in the UI) — do not set it to unknown hosts unless you understand where your data will go; (4) If you care about privacy of prompts/lyrics, review MakebestMusic's terms/privacy. Technical note: the included node scripts assume a Node runtime with global fetch available.
✗
scripts/generate.js:3
Environment variable access combined with network send.
✗
scripts/query.js:3
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk970an64j0y1y0fr1vvtmk2ew5833542

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

🎵 Clawdis
EnvapiKey
Primary envapiKey

Comments