ClawHub
Back to skill

Security audit

Ace Music Paid

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI music-generation guide that uses command-line/API workflows, with minor scoping and shell-safety caveats but no hidden or clearly unsafe behavior.

Install only if you intend to use an ACE Music API workflow and are comfortable giving the agent command execution for music-generation commands. Keep the API key in environment variables or a secrets manager, review generated file paths before moving files, and avoid running the archive example on untrusted command output without adding overwrite and path checks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The skill defines highly generic capability language such as executing operations on user input and returning results without narrowing when the skill should activate. In an agent environment, this can cause over-broad invocation and unintended handling of unrelated requests, increasing the chance that the skill triggers exec-backed workflows in contexts the user did not intend.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The coverage section enumerates broad keyword-like phrases and fragmented terms as supported scenarios without any activation boundaries. This makes matching overly permissive and can lead an agent to route loosely related prompts into a skill that supports `exec`, creating unnecessary exposure to command execution pathways.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The example pipeline moves files produced by a command directly into an archive directory using values read from command output, without warnings about overwrites, path validation, or destructive side effects. In an agent-assisted workflow, users may copy this pattern blindly, which can overwrite files, relocate unexpected paths, or modify local data outside the intended workspace.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.