Security audit
Security checks for vulnerabilities and agentic risk
This music-generation skill is not clearly malicious, but it asks for broad command and file authority that is not well scoped to its stated purpose.
Review this skill before installing. It does not show evidence of exfiltration or destructive behavior, but its shell execution and file access permissions are broader than the documented music-generation workflow. Prefer a version that removes exec or documents exact allowed commands, inputs, outputs, and API endpoints.
The skill declares generic exec capability alongside read and write even though the stated purpose is music generation. That creates an unnecessary execution surface where an agent may run arbitrary shell commands during normal use, enabling command injection, file tampering, or data exfiltration if later prompts or wrappers pass untrusted input into execution paths.
The document claims only allowlisted commands should be executed, but the metadata exposes unrestricted generic exec, which defeats that guidance in practice. This mismatch can mislead users and reviewers into believing the skill is constrained when the agent actually has broad command-execution power.
The invocation/use description says the skill should be used for broadly unrelated tasks such as video processing, audio editing, media conversion, and dubbing, despite being presented as a music-generation skill. Overbroad triggering increases the chance an agent invokes this skill in inappropriate contexts, expanding exposure to its powerful tools and encouraging unsafe task-routing.
No suspicious patterns detected.
