ClawHub
Back to skill

Security audit

ace-music

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a music-generation API guide, but it handles an API key and user content with unclear and sometimes unsafe instructions.

Review before installing. Use this only for content you are comfortable sending to ACE Music, store the API key in a proper secret mechanism instead of TOOLS.md or chat, and do not rely on the advertised video/media/file-processing claims unless the missing scripts and docs are supplied and reviewed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:32
Finding

Unsafe Plaintext Storage of API Credentials in TOOLS.md

Content
View full analysis
in the browser for the user 2. Ask them to sign up (free) and paste the API key 3. Store it: `export ACE_MUSIC_API_KEY=` or add to TOOLS.md ``` ### Technical Analysis The setup instructions explicitly offer `TOOLS.md` as a storage location for the ACE Music API key. This is an agent-readable plaintext documentation file rather than a dedicated secret store. Such files may be committed to source control, copied into backups, included in diagnostic output, indexed by development tools, or loaded into an AI agent's context. Storing the key in a process environment variable is generally appropriate when combined with secure process and logging practices. The alternative recommendation to add it to `TOOLS.md`, however, unnecessarily increases credential exposure and exceeds the minimum data access needed to generate music. The Skill also instructs clients to transmit the credential in an HTTPS `Authorization` header and send music prompts, lyrics, or audio to `https://api.acemusic.ai`. That network communication is necessary for the declared hosted music-generation functionality and no unrelated destination was identified. Nevertheless, the API key and submitted content remain sensitive data entrusted to a third-party service. ### Attack Path 1. A user follows the Skill's setup instructions and writes a valid ACE Music API key into `TOOLS.md`. 2. The file is subsequently committed to a repository, shared with collaborators, included in a support bundle, exposed through logs, or loaded into an agent or tool context. 3. An unauthorized party retrieves the plaintext API key from that location. 4. The party submits authenticated requests to the ACE Music API u ...[truncated 1033 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger keywords are extremely broad and overlap with ordinary language, making accidental activation likely. In an agent ecosystem, this can route unrelated user requests into a skill that performs external API interactions and file-generation steps, causing unintended disclosure of prompts or content to a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest advertises broad media-processing capabilities beyond music generation, but the documented implementation centers on a music-generation API. This mismatch can cause the skill to be invoked in contexts involving unrelated media tasks, leading users to send unnecessary content to an external service under false assumptions about capability and scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The description says "支持中文交互" while the document otherwise mixes languages and does not clearly state that language is optional or user-selectable for interaction. This can be interpreted as steering usage toward a specific locale/language without explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill does not clearly warn users that prompts, lyrics, and possibly audio inputs will be sent to an external service and that output audio may be written to disk. Missing consent and data-flow disclosure increases privacy risk, especially when users may provide sensitive or proprietary text/audio content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill gives contradictory setup guidance by saying no extra API key is needed while elsewhere requiring ACE_MUSIC_API_KEY for operation. This can mislead users and agents about required secret handling, increasing the chance that keys are pasted insecurely into chat, files, or logs instead of being provisioned through a controlled secret mechanism.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

示例1: 生成一首描述性音乐

python
import requests
url = 'https://api.acemusic.ai/generate'
headers = {'Authorization': 'Bearer YOUR_API_KEY'}
payload = {'text': 'A soothing melody for a calm evening', 'duration': 120}
response = requests.post(url, headers=headers, json=payload)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

示例1: 生成一首描述性音乐

python
import requests
url = 'https://api.acemusic.ai/generate'
headers = {'Authorization': 'Bearer YOUR_API_KEY'}
payload = {'text': 'A soothing melody for a calm evening', 'duration': 120}
response = requests.post(url, headers=headers, json=payload)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

示例1: 生成一首描述性音乐

python
import requests
url = 'https://api.acemusic.ai/generate'
headers = {'Authorization': 'Bearer YOUR_API_KEY'}
payload = {'text': 'A soothing melody for a calm evening', 'duration': 120}
response = requests.post(url, headers=headers, json=payload)

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

url = 'https://api.acemusic.ai/generate' headers = {'Authorization': 'Bearer YOUR_API_KEY'} payload = {'text': 'A soothing melody for a calm evening', 'duration': 120} response = requests.post(url, headers=headers, json=payload) print(response.json())

text
**预期输出**: 包含音乐文件的Base64编码和相关信息。

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

url = 'https://api.acemusic.ai/generate' headers = {'Authorization': 'Bearer YOUR_API_KEY'} payload = {'text': 'A soothing melody for a calm evening', 'duration': 120} response = requests.post(url, headers=headers, json=payload) print(response.json())

text
**预期输出**: 包含音乐文件的Base64编码和相关信息。

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.

url = 'https://api.acemusic.ai/generate' headers = {'Authorization': 'Bearer YOUR_API_KEY'} payload = {'text': 'A soothing melody for a calm evening', 'duration': 120} response = requests.post(url, headers=headers, json=payload) print(response.json())

text
**预期输出**: 包含音乐文件的Base64编码和相关信息。

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The instruction to log full API request contents can capture user prompts, lyrics, identifiers, and other sensitive material. Centralized logs often have broader access and longer retention than the original request path, so this expands the blast radius of any sensitive data disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation claims file-writing and broader file-processing capabilities even though the declared tool permission is read-only. This discrepancy can mislead users or calling agents into expecting file output behavior not authorized by the manifest, encouraging unsafe workarounds or trust in undocumented side effects.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.