音乐生成工具免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.0.2

Overview

The skill is a music-guidance Markdown package, but it asks for broad read/write/command execution authority and uses overly broad activation language outside its stated music purpose.

Review this skill before installing. It appears to be a documentation-style music helper, but its requested read/write/exec permissions are broader than needed and its activation language may pull it into unrelated media or automation tasks. Use it only in a constrained workspace or after narrowing/removing those permissions and tightening the trigger scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:26

Finding

Excessive Filesystem and Command-Execution Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-29
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill requests unrestricted read, write, and exec capabilities even though its documented functionality consists primarily of music-platform recommendations, lyric templates, style matching, and music-theory guidance. No implementation in the audited package requires arbitrary filesystem access or general command execution.

Granting these capabilities violates the principle of least privilege. If the hosting agent honors the declared tool list, instructions processed while this skill is active may access local files, alter data, or execute commands with the permissions of the agent process. The package contains no direct malicious command, but its unnecessarily broad authority increases the consequences of prompt injection, malicious future modifications, or unsafe user-supplied instructions.

Attack Path

1. A host loads the skill and grants the tools declared in its metadata.
2. The skill processes attacker-controlled or prompt-injected content during a music-related request.
3. Malicious instructions direct the agent to invoke read, write, or exec, despite those tools not being required for the legitimate task.
4. The agent reads accessible local information, changes files, or executes a command under the agent process's operating-system privileges.
5. The resulting data exposure or system modification extends beyond the skill's stated music-guidance purpose.

This path depends on the host granting the declared tools and failing to independently constrain unsafe tool calls.

Impact Assessment

The potential scope is bounded by the permissions of the process running the agent. Possible impact includes:

• Reading local files accessible to the agent, ...[truncated 524 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read and write, because the documented guidance and content-generation features do not require filesystem access.
2. Remove exec unless command execution is indispensable to a clearly defined feature. The optional ping troubleshooting advice does not justify unrestricted execution.
3. Prefer a tool-free Markdown skill for recommendations, lyric generation, prompt construction, and music-theory guidance.
4. If external-service integration is later implemented, expose narrowly scoped platform APIs rather than a general shell.
5. Where execution cannot be eliminated, enforce an explicit command allowlist, fixed arguments, timeouts, network restrictions, and sandboxing. Never concatenate untrusted input into commands.
6. Require user confirmation before any filesystem or command-execution operation and restrict the agent to a dedicated workspace with minimal operating-system privileges.
7. Add automated validation that rejects tool declarations not mapped to a documented and tested capability.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger keywords are excessively broad and include unrelated domains such as video processing, media conversion, automation, and machine learning. In an agent environment, this can cause the skill to activate for unrelated tasks and gain access to tools like exec/write/read outside its intended music-focused scope, increasing the risk of unsafe or unintended actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The display name, summary, and the example lyrics/configuration are all presented in Chinese, including a default lyric language of "zh" in the configuration example. While not always prohibited, the file does not state that users may choose another language, which can be a locale/language policy issue when the skill is presented as generally applicable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description mixes music generation with unrelated media-processing and voiceover use cases, creating an ambiguous activation boundary. In context, this is more dangerous because the skill declares exec/write/read capabilities, so scope confusion may lead an agent to apply this skill in workflows that it was never safely designed to handle.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The documentation says '无需额外API Key' at L365, which suggests no credential setup is needed for the skill itself. However, the immediately following lines state that users must register accounts on AI music platforms and may need to configure platform APIs, so the documentation downplays required external authentication/dependency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.