free-music-generator

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:28 AM UTC
• Version: 0.1.0

Overview

This appears to be a real Tunee music-generation skill, but it needs review because it routes broadly to an external credit-using service and encourages an unsafe API-key handling method.

Review before installing. Use a protected TUNEE_API_KEY configuration instead of passing --api-key on the command line, verify whether Tunee generation consumes paid or limited credits, and install only if you are comfortable sending prompts, lyrics, titles, model choices, and account-credit queries to Tunee's API.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils/api_util.py:156

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

str | None: """Resolve API Key in order: CLI argument > TUNEE_API_KEY.""" for key in (cli_key, os.environ.get("TUNEE_API_KEY")): if not key: continue key = key.strip() if not key: continue if key != "your-access-key-here": return key ``` It also instructs users to place a literal key in a command: ```python def print_api_key_help() -> None: """Print API Key configuration guide to stderr.""" print("Error: No API Key detected.", file=sys.stderr) print("", file=sys.stderr) print("Configure via one of:", file=sys.stderr ...[truncated 2834 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code does not perform music creation, lyric generation, composition, or any other content-generation behavior described in the declaration. Its sole function is an account-related operation: fetching remaining credits. While the declared description does mention account actions like credits/balance, the overall declared purpose emphasizes a comprehensive music creation skill that should trigger for any AI music or lyric creation request. That is materially broader and different from this code chunk’s actual behavior. Therefore, the description does not accurately represent what this specific code actually does.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions are extremely broad and designed to activate on almost any music- or creativity-related phrasing. Overbroad routing can cause the agent to invoke this skill unexpectedly, sending user prompts to external scripts/services and using credentials in contexts where another skill or no tool should have been used.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to use environment secrets, invoke scripts, and access the network, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization gap where the runtime may permit broader execution than reviewers or orchestration logic expect, increasing the chance of unintended script execution or secret exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instruction to prefer this skill over any other music tool can override safer or more appropriate alternatives and biases routing toward this external service. In a multi-skill environment, that can lead to unnecessary external calls, excessive privilege use, and reduced user choice.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

**`--title`**: Required. Song or track title. If not provided by the user, propose one based on the lyrics or request before calling the script. Title naming rules:
- Derive from the lyric content or the user's stated theme
- Length: 2–6 characters for Chinese titles; 1–4 words for English titles
- Do not ask the user to confirm the title unless they have expressed a preference — propose and proceed

**`--model`**: Must be the `id` of a model from the **complete `list_models.py` stdout** already in this conversation. Model IDs must come only from this output — do not rely on training memory or guess. If the output does not exist yet, run `list_models.py` first before generating.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

API Key Not Configured

Do not run any script. Reply:

text

Welcome to Tunee Music 🎵

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

After a user says "continue," the skill is instructed to re-check credits and proceed to generation without re-confirming the pending action. That enables an external operation to occur on resumed context with limited fresh consent, which is risky when credits are consumed or stale context may be misunderstood.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Top up here → https://www.tunee.ai/en/home/ai-music

text

When the user replies "continue" (or the equivalent in their language): re-run `credits.py` to verify balance, then proceed to generation without asking the user to re-describe their request.

### Error Messages by Code

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document uses Chinese lyric examples and a Chinese-only prohibited-word list, which effectively steers output toward a specific language/locale. Because the guide does not explicitly offer a language option or justify that the skill is region- or language-specific, this can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Line L009 explicitly requires 'Comma-separated English keywords only.' This is a natural-language locale restriction, and the file does not provide a user choice or explain a necessary reason for enforcing English-only input.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/utils/api_util.py (reported line 142)May include surrounding context.

python

def request_tunee_api(url: str, access_key: str, json_payload: dict, timeout: int = 10) -> TuneeResponse:
    """POST request. Returns TuneeResponse on success; raises TuneeAPIError or RequestException on failure."""
    headers = build_headers(access_key)
    resp = requests.post(url, json=json_payload, headers=headers, timeout=timeout)
    raw = resp.json() if resp.content else {}
    err = parse_tunee_error(resp.status_code, raw)
    if err is not None:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code persists model data returned from the remote API into ~/.tunee/models.json, which is a file write affecting the user's local system. Although the function has an internal docstring, there is no confirmation prompt, logging, or other user-visible warning in this file to disclose that remote data will be cached on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The function makes an HTTP/API request using the provided access key to retrieve model information, but there is no print, log, prompt, or other visible disclosure in this file that a network call will occur. For safety auditing, outbound requests that transmit credentials or system-associated data should have some user-facing warning unless already clearly disclosed elsewhere in the skill's description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.