Security audit

Crazyrouter Music Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill does generate music as advertised, but it has an under-documented endpoint override that can send the API key and user prompts to another server.

Review before installing. Use this only in an environment where CRAZYROUTER_BASE_URL cannot be set by untrusted parties, use a limited Crazyrouter API key if available, avoid submitting sensitive lyrics or prompts, and choose output paths carefully because existing writable files may be overwritten.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.mjs:4
Finding: API Credential Disclosure Through an Unrestricted Endpoint Override<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.mjs:4, 37-42` **Vulnerability Type**: Unvalidated API endpoint override resulting in credential and data disclosure **Risk Level**: High ### Vulnerable Code ```js const API_BASE = process.env.CRAZYROUTER_BASE_URL || "https://crazyrouter.com/v1"; ``` ```js const response = await fetch(`${API_BASE}/chat/completions`, { method: "POST", headers: { "Authorization": `Bearer ${apiKey}`, "Content-Type": "application/json" }, body: JSON.stringify({ model: args.model, messages: [{ role: "user", content: userContent }] }), }); ``` ### Technical Analysis The destination receiving the authenticated API request is controlled by the `CRAZYROUTER_BASE_URL` environment variable. The code does not validate the URL scheme, hostname, port, or origin before attaching the `CRAZYROUTER_API_KEY` as a bearer token. An attacker capable of setting or influencing this environment variable can redirect the request to an attacker-controlled HTTP server. The resulting request contains both the API credential and user-provided content, including the prompt, lyrics, and title. The override is not documented in `SKILL.md`, reducing the likelihood that users or operators will recognize that the credential can be sent to a destination other than Crazyrouter. Use of an `http://` URL would also transmit the credential and content without transport encryption. ### Attack Path 1. The attacker gains the ability to set or influence environment variables for the Skill invocation, deployment configuration, wrapper script, or Agent runtime. 2. The attacker sets `CRAZYROUTER_BASE_URL` to an endpoint under their control, such as `https://attacker.example/v1`. 3. A user invokes the Skill with a valid `CRAZYROUTER_API_KEY`. 4. The script sends a request to `https://attacker.example/v1/chat/completions`. 5. The request includes `Authorization: Bearer <CRAZYROUTER_API_KEY>`. 6. The request body also discloses the user's prompt, l ...[truncated 708 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove `CRAZYROUTER_BASE_URL` if endpoint customization is not required. - If endpoint customization is necessary, parse the value with the standard `URL` API and enforce: - The `https:` scheme. - An explicit allowlist of trusted hostnames. - An approved port, normally TCP 443. - An expected path prefix. - No embedded username or password. - Keep the credential scoped to Crazyrouter and do not attach it to requests whose origin differs from the approved API origin. - Explicitly validate redirect behavior. Disable redirects or reject any redirect that changes the trusted origin before resending an authorization header. - Document every supported environment variable and its security implications in `SKILL.md`. - Use a narrowly scoped API key where supported, apply usage limits, and rotate any key that may have been exposed. - Consider accepting endpoint changes only through trusted administrative configuration rather than the general process environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.mjs:47
Finding: Unrestricted Server-Controlled URL Fetching and Unbounded Audio Download<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.mjs:47-58` **Vulnerability Type**: Server-side request forgery and unbounded memory/storage consumption **Risk Level**: Medium ### Vulnerable Code ```js const urlMatch = content.match(/https?:\/\/[^\s"'<>]+\.(mp3|wav|m4a|ogg|flac)[^\s"'<>]*/i) || content.match(/https?:\/\/[^\s"'<>]+audio[^\s"'<>]*/i) || (audioUrl ? [audioUrl] : null); if (urlMatch && args.output) { const url = urlMatch[0]; console.error(`Downloading audio from: ${url}`); const audioResponse = await fetch(url); if (audioResponse.ok) { const buffer = Buffer.from(await audioResponse.arrayBuffer()); await writeFile(args.output, buffer); console.error(`Saved: ${args.output} (${(buffer.length / 1024 / 1024).toFixed(1)}MB)`); ``` ### Technical Analysis The script extracts an arbitrary HTTP or HTTPS URL from an API response and fetches it without validating its destination. It does not restrict the hostname, resolve and reject private IP address ranges, enforce HTTPS, constrain redirect destinations, or verify that the response is audio data. Because the API response determines the fetched URL, a malicious or compromised API endpoint can cause the Agent host to issue requests to loopback, link-local, private-network, or cloud metadata services. This creates an SSRF primitive from the network context of the process. Although the script does not print the downloaded body directly on a successful request, it writes the response to the selected output file, allowing retrieval of internal response content where the caller can access that file. The entire response is read using `arrayBuffer()` and then copied into a Node.js `Buffer`. There is no timeout or maximum response-size limit. A remote server can therefore return a very large or indefinitely slow response, causing excessive memory consumption, process termination, storage exhaustion, or prolonged resource occupancy. The response is written to the caller ...[truncated 2020 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Permit downloads only from an explicit allowlist of trusted media hosts controlled or approved by the service operator. - Require HTTPS and reject URLs containing credentials, unexpected ports, or unsupported schemes. - Resolve destination hostnames and reject loopback, link-local, private, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6. - Protect against DNS rebinding by validating the actual connected address, not only the initial DNS result. - Disable redirects or validate every redirect target using the same scheme, hostname, port, and IP-address controls. - Apply an abort timeout with `AbortController`. - Check `Content-Length` before downloading where available, while also enforcing a streaming byte limit because the header can be absent or dishonest. - Stream the response to disk rather than buffering the entire file in memory. - Validate the response `Content-Type` against an allowlist of expected audio media types. - Resolve the output path against an approved output directory and reject traversal outside that directory where arbitrary paths are not required. - Use exclusive file creation or explicit overwrite confirmation to prevent unintended replacement of existing files. - Delete partial output files when validation, download, or write operations fail. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The skill description includes broad activation phrases like 'generate music', 'create a song', 'compose', and 'make audio content', which can cause the agent to invoke the skill for loosely related requests. Over-broad routing increases the chance of unnecessary external API use and unintended disclosure of user prompts to a third-party service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill documentation does not warn that prompts, lyrics, and possibly titles are sent to the external Crazyrouter service. Users may provide sensitive or proprietary text without realizing it will leave the local environment, creating privacy, confidentiality, and compliance risks.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/main.mjs:5