Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a legitimate ACE music-generation guide, but it asks for command execution and file-writing authority while its activation scope and automation claims are broader than the stated music purpose.
Review before installing. Use this only for ACE music-generation tasks, provide an API key through environment variables, and only process audio you are authorized to use. Be cautious about letting it run shell commands or write files for generic video, conversion, dubbing, or broad automation tasks because those are not clearly scoped in the artifact.
The skill states it is not suitable for copyrighted media, yet explicitly documents cover/repaint workflows that transform user-supplied source audio. This creates a contradictory safety boundary that can mislead operators and normalize potentially infringing processing of protected works, especially in an exec-enabled skill intended for automation.
The invocation text includes broad media tasks like video processing, audio editing, media conversion, and dubbing generation, which extend well beyond the named ACE music tool. Overly broad triggers can cause the skill to activate in unrelated contexts, increasing the chance that exec/write functionality is applied when users did not intend to use this specific skill.
The description presents Chinese interaction as a fixed mode without indicating user choice or fallback behavior. While not a direct code-execution flaw, mandatory locale behavior can cause misinterpretation of prompts, unexpected skill activation patterns, and reduced user control over how commands and outputs are handled.
The coverage keywords list is extremely broad and includes fragmented, generic phrases, making the skill match a wide set of prompts without meaningful constraints. In combination with exec and write permissions, this broad matching raises the risk of accidental invocation and misuse in workflows outside the reviewed scope.
The skill is presented as a music-generation tool, but later sections claim broad automation abilities such as file parsing, data aggregation, and generic command execution/result collection. In an exec-capable skill, this scope drift increases the chance of unintended or abusive use beyond the declared purpose, weakening user expectations and policy enforcement.
The feature note highlights Chinese interaction as part of the core capability, but it does not indicate that other languages are available based on user preference. This can be read as a fixed language expectation rather than an opt-in locale choice.
No suspicious patterns detected.
