Byted Music Generate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.0

Overview

The skill appears to generate music as advertised, but it needs review because it tells agents to store Volcengine API credentials in a workspace file.

Install only if you are comfortable sending prompts, lyrics, and music metadata to Volcengine and potentially incurring API charges. Do not let the agent write VOLCENGINE_ACCESS_KEY or VOLCENGINE_SECRET_KEY into repository or workspace files; configure them through a secure secret store or process-scoped environment variables, and prefer pinned dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:157

Finding

Unsafe Instruction to Persist API Credentials in the Workspace

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157-159
Vulnerability Type: Unsafe secret storage instruction
Risk Level: Medium

Affected content:

markdown

- `PermissionError: VOLCENGINE_ACCESS_KEY ...`: Inform the user to configure the environment variables. Write them to the workspace environment variable file, then retry.
- `status: "timeout"`: The task is still generating. Provide the user with the `task_id` and the manual query command from the output.
- Copyright check failure (code 50000001): Suggest the user enrich the description or increase the audio duration, then retry.

Technical Analysis

The Skill instructs the Agent to write the Volcengine access key and secret key to an unspecified workspace environment-variable file. Workspace files are not necessarily protected secret stores. Depending on the execution environment, they may be included in source-control commits, artifacts, backups, indexing systems, diagnostic output, or files shared with other workspace users.

The executable script itself reads credentials through os.getenv and does not transmit the secret key directly. It uses the secret key locally to produce an HMAC signature for the declared Volcengine HTTPS endpoint. Therefore, persistent workspace storage is not required for the Skill's declared functionality and exceeds the minimum necessary exposure of the credentials.

Attack Path

1. The Skill is executed without VOLCENGINE_ACCESS_KEY or VOLCENGINE_SECRET_KEY.
2. Following the documented recovery instruction, the Agent obtains the credentials and writes them into a workspace environment file.
3. The file is accidentally committed, uploaded as an artifact, indexed, backed up, logged, or made accessible to another workspace user or process.
4. An attacker or unauthorized user reads the access key and secret key.
5. The recovered credentials are used to authenticate directly to Volcengine APIs within t ...[truncated 418 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the workspace-storage instruction with guidance to use a platform-managed secret store, credential vault, or process-scoped environment variables.
• Explicitly prohibit storing credentials in repository files, workspace configuration committed to source control, shell history, command-line arguments, or generated artifacts.
• If a local environment file must be supported, require it to be outside the repository, restricted to the current user, and excluded from source control and artifact collection.
• Add a documented least-privilege requirement for the Volcengine credentials and recommend dedicated, narrowly scoped credentials rather than account-wide keys.
• Recommend credential rotation and immediate revocation if a key is accidentally written to a shared or version-controlled location.

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Weakens Build Reproducibility

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-2
Vulnerability Type: Unbounded third-party dependency version
Risk Level: Low

Affected content:

text

# Volcengine Music Generation skill dependencies
requests>=2.28.0

Technical Analysis

The requirement accepts every future version of the requests package at or above version 2.28.0. No lockfile or package hashes are provided. Consequently, separate installations of the same audited Skill may resolve to different dependency versions, including releases that were not part of this review.

The package name is legitimate and the project does not use an untrusted package index, typo-squatted name, or direct remote source. This is therefore a supply-chain hardening weakness rather than evidence that the current dependency is malicious.

Attack Path

1. A user or automated environment installs the Skill's dependencies at a later date.
2. The package resolver selects a newer requests release because the requirement has no upper bound or exact version.
3. If that selected release or its resolved dependency chain is compromised or contains a security regression, the affected code is installed into the Skill's environment.
4. The dependency executes when scripts/music_generate.py imports or uses requests.
5. Compromised dependency code could act with the same operating-system and network privileges as the Skill process.

This path requires a compromised or vulnerable future dependency release; no such compromise was identified in the audited project.

Impact Assessment

A malicious dependency could potentially read process environment variables, including the Volcengine access key and secret key, modify API requests, exfiltrate user prompts or lyrics, or execute other actions available to the Skill's operating-system account. The effective scope is limited to the filesystem, network, environment, and other permissions gra ...[truncated 52 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and its transitive dependencies to reviewed versions through a lockfile or fully resolved requirements file.
• Use hash verification, such as pip's --require-hashes, to ensure downloaded distributions match approved artifacts.
• Install packages only from an explicitly configured trusted package index over TLS.
• Use automated dependency monitoring to identify known vulnerabilities and intentionally update pinned versions after review and testing.
• Rebuild the lockfile regularly rather than relying indefinitely on obsolete versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs use of environment variables and an external API but does not declare any explicit tool scope or permissions boundaries. This increases the chance that an agent may invoke network access or read credentials without transparent, least-privilege constraints, which is a real security governance issue for a third-party integration skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says to use the skill when the user wants to create songs, background music, soundtracks, write lyrics, or mentions broad terms like "BGM" or "songwriting." These phrases are generic enough to overlap with ordinary conversation and the file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends prompts, lyrics, and related creative content to an external API but does not warn users that their content will leave the local environment. This creates a real privacy and consent issue, especially because lyrics or prompts may contain sensitive personal or proprietary information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions include broad intents such as wanting to generate a song, needing background music, or mentioning terms like "lyrics" and "background music." Without narrower scope, explicit constraints, or examples of non-matching cases, these conditions could cause unintended invocation for casual or exploratory requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The song mode parameter description states that --prompt must be Chinese, which is a language restriction presented as a default capability constraint. The file does not explain this as a region-specific limitation or instruct the agent to obtain user opt-in for that language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The lyrics mode parameter description says the prompt is "Chinese only," which forces a specific language/locale behavior. The file does not provide a user choice, opt-in flow, or a clear justification that this is a narrowly scoped regional tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly tells the agent to write Volcengine credentials into a workspace environment variable file. Persisting secrets into the workspace materially increases exposure through logs, source control inclusion, later tool reads, or unintended disclosure to other tasks, and this persistence is not necessary just to generate music.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This client sends user-supplied prompts, lyrics, and music metadata to an external third-party API endpoint. In an agent-skill context, that can expose sensitive or proprietary user content without clear disclosure or consent, especially because prompts may contain unpublished lyrics, business content, or personal data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file explicitly constrains Song Lang to three language options and documents them as the available language outputs. Under the policy, language or locale constraints should either offer user choice or be clearly justified; here the limitation is stated without justification or broader opt-in context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.28.0, which allows any future version to be installed and makes builds non-reproducible. This can unintentionally introduce vulnerable, breaking, or malicious upstream releases over time, and the risk is slightly more relevant here because this skill likely performs outbound API calls for music generation using requests.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

# Volcengine Music Generation skill dependencies
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Because requests is not pinned, it is impossible to verify from this manifest whether the installed version includes fixes for known advisories affecting older releases. In a skill that likely makes HTTP requests to an external API, using an affected version could expose data or weaken transport/security guarantees depending on runtime resolution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code accesses VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY from the environment, which is a sensitive-credential operation covered by the warning requirement for code files. Although the module docstring mentions HMAC authentication, there is no proactive user-facing warning, confirmation, or explanatory comment at the point of use that the skill will read credentials from environment variables.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.