ClawHub
Back to skill

Security audit

Music Toolkit Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a local music-generation and audio-processing guide that uses expected file writes and command execution, with some documentation ambiguity users should notice.

Before installing, treat this as a skill that can run local commands and write media files. Use a dedicated project/output folder, check filenames before running examples, and remember that while audio processing is described as local, the agent itself may still process your prompts through its configured LLM service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The skill repeatedly claims that all processing is local and that the free edition focuses on local creation, yet the dependency section states that an LLM API inference service is required. This creates a trust and data-flow mismatch: users may provide prompts or file-derived content assuming it never leaves the host, when in practice an external model provider may process it.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The feature matrix says AI arranging is not supported in the free version, but the dependencies later declare a required LLM API. That contradiction can mislead users about hidden AI-backed behavior and whether their inputs are routed to an external service despite the product being described as a limited local free edition.

Missing User Warnings

Low
Confidence
74% confidence
Finding
The documentation describes export/save/create operations but does not prominently warn that these actions write files locally and may overwrite existing paths. In an agent context with write and exec capabilities, insufficient notice can lead to unintended local file modification or user surprise about side effects.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The included examples write MIDI and audio files directly to fixed filenames such as 'melody.mid' and output media files without a user-facing warning. In practice, this can overwrite prior work or cause unintended filesystem changes when an agent follows examples literally.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.