ClawHub
Back to skill

Security audit

音乐

Security checks across malware telemetry and agentic risk

Overview

This music-generation skill asks for broad read, write, and command-execution authority without clearly limiting those powers to music creation.

Review this skill before installing. It may be reasonable for trusted media automation, but only grant it read, write, exec, and credential access in a sandbox or project directory, and avoid using it where unrelated local files, secrets, or accounts are accessible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill is described as a music-generation tool, yet later claims generic file handling, API integration, and command execution capabilities. This capability expansion is dangerous because it broadens the effective trust boundary and may cause an agent or operator to permit sensitive operations unrelated to the stated purpose, increasing the risk of misuse or prompt-injection-assisted abuse.

Intent-Code Divergence

Medium
Confidence
87% confidence
Finding
The file presents itself as a music-generation skill but later advertises broad automation behavior that contradicts that narrow intent. Such mismatched documentation can mislead users and agents into invoking the skill in inappropriate contexts, masking risky capabilities behind a benign label.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The invocation/usage description is overly broad, including vague statements about when to use the skill beyond a narrowly defined music-generation task. Ambiguous activation criteria can cause unintended routing or invocation by an agent, especially in mixed media or automation workflows, leading to unnecessary exposure of powerful tools like exec/read/write.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.