Security audit

Huo15 Ai Music Composer

Security checks for vulnerabilities and agentic risk

Overview

This is a real AI music and voice-cloning skill, but it should be reviewed carefully because it handles sensitive voice data and includes insecure server and deployment defaults that could expose files, jobs, or stored media.

Install only in an isolated test environment unless the server code and deployment templates are fixed. Do not upload anyone's voice without explicit permission, rotate or replace all default secrets, bind Redis and MinIO to private interfaces, avoid the documented public/default deployment as-is, and require clear retention and deletion controls for recordings, voice models, lyrics, and generated media.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/ai_music_server.py:302
Finding: Arbitrary Server-Side File Read Through User-Controlled Voice Sample Path
Content: View full analysis
Dict: """Train the voice-cloning model.""" async with self.session or aiohttp.ClientSession() as session: with open(audio_path, 'rb') as f: data = aiohttp.FormData() data.add_field('audio_file', f, filename='voice_sample.wav') data.add_field('model_name', model_name) async with session.post( f"{self.base_url}/train", data=data, timeout=aiohttp.ClientTimeout(total=900) ) as response: ``` ```python # scripts/generate_music.py:313-320 async def preprocess_audio(self, audio_path: str, target_sample_rate: int = 48000) -> str: """Preprocess audio.""" async with aiohttp.ClientSession() as session: with open(audio_path, 'rb') as f: data = aiohttp.FormData() data.add_field('audio_file', f) ...[truncated 2155 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/ai_music_server.py:325
Finding: Missing Object-Level Authorization for Job Status and Cancellation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ai_music_server.py:29
Finding: Hardcoded JWT Signing Secret Allows Authentication Forgery
Content: View full analysis
`. 5. `jwt.decode()` accepts the forged token. 6. The attacker gains access to every endpoint protected only by this middleware. 7. The attacker can then exploit the arbitrary-file-read vulnerability or attempt cross-user job oper ...[truncated 544 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_environment.py:229
Finding: Generated Deployment Exposes Unauthenticated Redis and MinIO With Default Credentials
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:5
Finding: Unpinned Packages and Mutable External Container Images Create Supply-Chain Exposure
Content: View full analysis
=2.0.0,!=2.1.0 torchaudio>=2.0.0 numpy>=1.24.0,<2.0.0 scipy>=1.10.0 aiohttp[speedups]>=3.8.0 redis>=4.5.0 aiofiles>=23.0.0 PyJWT>=2.6.0 bcrypt>=4.0.0 tqdm>=4.65.0 pydub>=0.25.1 librosa>=0.10.0 soundfile>=0.12.0 ffmpeg-python>=0.2.0 pyyaml>=6.0 python-dotenv>=1.0.0 requests>=2.31.0 click>=8.1.0 ``` ```python result = subprocess.run([ sys.executable, '-m', 'pip', 'install', '-r', requirements_file, '--no-cache-dir', '--upgrade' ], capture_output=True, text=True) ``` ```yaml redis-cache: image: redis:7-alpine minio-storage: image: minio/minio:latest voice-clone-service: image: registry.huo15.com/ai-music/voice-clone:v4.1 music-gen-service: image: registry.huo15.com/ai-music/suno-engine:v4 lyrics-service: image: registry.huo15.com/ai-music/lyrics-gpt7:latest audio-process-service: image: registry.huo15.com/ai-music/audio-process:v4 ``` ### Technical Analysis Most Python dependencies use broad minimum-version constraints rather than exact versions and hashes. The installer also uses `--upgrade`, allowing future package releases to be selected and executed without being represented in the audited artifact. The generated Compose configuration executes externally hosted proprietary images whose contents are not included in the project. Some images use the mutable `latest` tag, and the remaining tags are not pinned to immutable image digests. A registry operator or compromised registry account can therefore change the bytes executed by future installations without changing this project. This is supply-chain exposure rather than evidence that the currently named packages or images are malicious. The risk arises because the reviewed ...[truncated 1342 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (97)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is music generation, but the behavior includes environment probing, Docker/container enumeration, dependency installation, infrastructure file generation, and writing default service credentials. That mismatch is dangerous because it expands the attack surface beyond user expectations and could enable unauthorized system inspection, deployment changes, or insecure secret handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill processes highly sensitive voice samples and produces voice clones, but it does not clearly warn users about privacy, consent, retention, misuse risk, or biometric sensitivity. In a voice-cloning context, missing disclosure materially increases the chance of non-consensual cloning, unauthorized sharing, and unsafe handling of biometric data.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/api-reference.md (reported line 259)May include surrounding context.
请求

http
DELETE /api/v1/job/{job_id} Authorization: Bearer {token}

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document provides implementation guidance for voice cloning, including extraction of speaker embeddings and cloning workflows, but omits any consent, impersonation, retention, or biometric-data handling requirements. Because voiceprints are sensitive biometric identifiers and the skill explicitly clones a user's voice, this omission materially increases the risk of non-consensual cloning, privacy violations, and impersonation abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill processes highly sensitive biometric voice data for cloning, retains trained voice models long-term, and tracks user activity, but the specification does not document explicit consent flows, privacy warnings, retention limits for biometric artifacts, or safeguards against unauthorized impersonation. In the context of a voice-cloning music skill, that omission is especially dangerous because misuse can enable identity abuse, non-consensual synthesis, and persistent storage of reusable voiceprints/models beyond a single generation task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The quick start references model downloads and multiple local HTTP services but does not disclose whether user audio, lyrics, or metadata may be sent across service boundaries or to externally sourced components. In a skill handling voice samples, this omission is security-relevant because users cannot make an informed decision about data exposure, especially when several microservices and downloads are involved.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · QUICK_START.md (reported line 18)May include surrounding context.
软件依赖

bash
# Linux/Unix 系统 sudo apt update sudo apt install -y ffmpeg libsndfile1 libgl1-mesa-glx # macOS

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · QUICK_START.md (reported line 19)May include surrounding context.
软件依赖

bash
# Linux/Unix 系统 sudo apt update sudo apt install -y ffmpeg libsndfile1 libgl1-mesa-glx # macOS

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide instructs users to upload or process their own voice samples for cloning without any warning about consent, retention, deletion, or the biometric sensitivity of voice data. Because voiceprints are identifiable biometric data and the skill explicitly enables impersonation-style output, missing privacy and consent safeguards materially increases the risk of unauthorized cloning, misuse of another person's voice, and unsafe handling of sensitive recordings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README prominently advertises zero-shot voice cloning from a 30-second sample but provides no consent, privacy, biometric-data, or misuse warning. Because voiceprints are sensitive biometric data and the skill is explicitly designed to imitate a person's voice, omission of these safeguards increases the risk of non-consensual cloning, impersonation, and unsafe handling of highly sensitive user recordings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The architecture and workflow describe multiple generation services and storage components, but the README does not clearly warn users that uploaded audio and lyrics may be transmitted to external/API-backed services for processing. This lack of transparency can expose private voice recordings, copyrighted lyrics, or sensitive creative content to third-party systems without informed user consent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README for an AI music composer directs users to a clearly unrelated fireworks-simulator.huo15.com domain at the end, which is a strong trust-boundary violation and phishing/social-engineering indicator. In the context of an installable skill that also references external APIs, support channels, and deployment steps, this can mislead users into visiting an attacker-controlled or deceptive site for downloads, credentials, payments, or further instructions.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises capabilities implying file, network, and shell interactions, but it does not declare any explicit tool scope or permission boundaries. This weakens least-privilege controls and makes it harder for a host system or reviewer to understand and constrain what the skill may access at runtime.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "生成一首歌" is broad enough to match many normal conversations unrelated to this specific skill. Overbroad activation can cause unintended invocation of a skill that handles sensitive voice data and potentially performs file, network, or shell operations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The alias "AI唱歌" is ambiguous and likely to overlap with many harmless user requests about singing, music, or entertainment. Because this skill involves voice cloning and backend operations, accidental activation increases privacy and safety risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The alias "生成一首歌" is too vague and may match ordinary requests that do not imply consent for voice cloning or advanced system actions. In this skill's context, unintended invocation is more dangerous because users may be prompted for or process sensitive biometric voice samples.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 8)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 18)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 26)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 51)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 191)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 473)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 516)May include surrounding context.
md
AI 音乐创作引擎提供 RESTful API 接口，支持端到端的音乐生成流程。所有接口均使用 JSON 格式传输数据。 ### 基础信息 - **基础 URL**: `https://api.huo15.com/music/v1` - **认证方式**: JWT Bearer Token - **请求格式**: JSON - **响应格式**: JSON

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/api-reference.md (reported line 18)May include surrounding context.
bash
# 获取认证令牌 curl -X POST https://api.huo15.com/auth/login \ -H "Content-Type: application/json" \ -d '{ "api_key": "your_api_key",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The upload API documents sending a user's voice recording to a remote service but does not warn that biometric voice data is being transferred, stored, and processed off-device. Because voice samples are highly sensitive personal data and this skill explicitly performs voice cloning, missing disclosure materially increases privacy and consent risk.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Missing User Warnings

Tool Parameter Abuse

请求

Missing User Warnings

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

软件依赖

Sudo/Root Execution

软件依赖

Missing User Warnings

Missing User Warnings

Missing User Warnings

Intent-Code Divergence

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Vague Triggers

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Missing User Warnings