ClawHub
Back to skill

Security audit

ACE Music AI音乐LITE

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a music-generation helper, but its instructions are materially overbroad and inconsistent about what tasks it should handle.

Review this before installing. Use it only for new text-to-music generation, not for existing video/audio editing or media conversion. Do not paste the ACE Music API key into chat; configure it outside the agent session. Treat prompts and lyrics as data sent to ACE Music's hosted API, and choose output filenames/locations deliberately because generated MP3 files are written locally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description advertises use for unrelated tasks such as video processing, audio editing, media conversion, and dubbing generation even though the skill is presented as a music-generation client. Overbroad invocation language can cause an agent to select this skill in inappropriate contexts, increasing the chance of unnecessary command execution, unintended file writes, and third-party data disclosure to the hosted API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description omits a clear privacy warning that user prompts and custom lyrics are sent to a third-party hosted API. Because lyrics and prompts may contain proprietary, personal, or otherwise sensitive content, this omission can lead users to disclose data externally without understanding the privacy boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

At L092 the documentation states the skill must '永不接受/回显/存储来自聊天输入的 Key'. However, later instructions at L127-L131 direct the user to set ACE_MUSIC_API_KEY="你的Key", which in an agent-mediated workflow can amount to supplying the key through the interaction flow the document says must not be used.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation defines a narrow scope at L120 and again at L156-L159: text-to-music only, not modifying existing media. But later sections claim efficiency for '修改现有歌词以适应新风格' (L264) and describe usage '需要视频处理、音频编辑、媒体转换、配音生成时使用' (L012), which expands the implied function beyond the stated capability boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation says the script will decode and write generated output to an MP3 file but does not prominently warn users that files will be created on local disk. In agent environments with write and exec permissions, silent file creation can surprise users, overwrite existing files, or leave sensitive/generated content stored locally without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The documentation states '永不打印或暴露 Key' at L083, presenting a strict no-output claim regarding key handling. Immediately after, it shows a shell command that prints ok or missing based on whether the secret is set, which is not key disclosure but does contradict the absolute wording of 'never print' around key-related handling.

Content

No source excerpt is available for this finding.