Huo15 Ai Music Composer

• Outcome: Review
• Latest audit: Jul 18, 2026 · 5:01 PM UTC
• Version: 1.0.0

Overview

This skill’s music-generation purpose is coherent, but it handles sensitive voice-cloning data and deploys broad local services without enough consent, privacy, credential, and scoping safeguards.

Review this skill carefully before installing. Use it only with voices you own or have explicit permission to clone, run it in an isolated environment, avoid custom requirements files, inspect the Docker images, change all default MinIO and JWT secrets, bind services to private interfaces, and require clear retention/deletion controls for uploaded voice samples and trained voice models.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (56)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            print("📦 安装 Python 依赖...")
            result = subprocess.run([
                sys.executable, '-m', 'pip', 'install', '-r', requirements_file,
                '--no-cache-dir', '--upgrade'
            ], capture_output=True, text=True)

• Confidence: 91% confidence
• Finding: The script can install arbitrary packages from a caller-supplied requirements file via --requirements, which expands the skill from passive setup into code-fetching and package execution from external indexes. In a skill context, this increases supply-chain risk and can lead to untrusted code execution during installation if a malicious or tampered requirements file is provided.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 检查运行中的容器
            try:
                ps_result = subprocess.run(['docker', 'ps', '--format', 'json'], 
                                         capture_output=True, text=True)
                if ps_result.returncode == 0:
                    # 解析 JSON 格式的容器列表

• Confidence: 94% confidence
• Finding: Listing running Docker containers inventories unrelated host workloads and reveals names, images, and status for containers outside the music skill's scope. In a setup script, this is over-collection of sensitive environment data and can leak operational details if shown to users, logs, or telemetry.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises operational capabilities implying file access, shell execution, and network use, but declares no permissions. This undermines user and platform visibility into what the skill can do and weakens consent and policy enforcement, especially because it handles uploaded audio and deployment-related actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior extends well beyond music generation into host inspection, dependency installation, Docker/container enumeration, service deployment, API exposure, and server-side file storage. That mismatch increases the chance of users or reviewers approving a skill for a narrow creative task when it can also alter the environment and expose new attack surface.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The API documentation exposes detailed operational telemetry such as GPU, memory, disk usage, active job counts, and internal service health states. While not directly exploitable on its own, this information gives attackers useful reconnaissance about backend capacity, architecture, and timing for abuse or denial-of-service attempts.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly shows automatic discovery and dynamic import/execution of plugin files from a local directory via importlib, which grants arbitrary code execution to any plugin placed in that path. In a skill ecosystem, this meaningfully expands capability beyond music generation into general-purpose code execution, and the document provides no trust boundary, signing, sandboxing, or approval controls.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The documentation adds custom HTTP endpoints that turn the skill into a more general service surface, including accepting user-supplied paths and processing requests outside the core song-generation workflow. This increases attack surface and can enable misuse or insecure integrations if copied into production without authentication, authorization, input validation, and scope restrictions.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The system-status endpoint exposes operational telemetry such as total jobs, active jobs, Redis memory usage, concurrency settings, uptime, and GPU usage to any authenticated user without role-based restriction. This can aid reconnaissance by revealing infrastructure capacity and workload characteristics that are unrelated to normal music-generation use.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script inspects all running Docker containers on the host, which is unrelated to the declared end-user function of music composition and may expose sensitive infrastructure details. In a skill environment, this broad host inventorying is unnecessary and increases privacy and reconnaissance risk.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The generated configuration embeds default MinIO credentials (minioadmin / minioadmin123), which are well-known and unsafe if the service is exposed or reused in non-local deployments. Hard-coded default secrets create an easy path to unauthorized storage access and data compromise.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs users to provide voice samples for cloning, which involves processing biometric voice data, but it omits any warning about consent, identity misuse, retention, or sharing risks. In a voice-cloning skill, this omission is especially serious because cloned voices can enable impersonation, fraud, or non-consensual content generation if samples are uploaded or reused without clear safeguards.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The setup instructions tell users to run system package installation and Docker startup commands that modify the host environment and may download and execute external software, but they do not warn about those effects. This is a genuine safety issue, though lower severity, because users may run commands without understanding the trust and system-change implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README promotes collection and processing of user voice recordings, which are sensitive biometric-like audio data, but provides no user-facing warning about privacy, retention, consent, or downstream misuse. In a skill centered on cloning a user's voice, omission of these safeguards can lead to unauthorized collection, reuse, or disclosure of highly sensitive personal data.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Advertising zero-shot voice cloning without an explicit warning about impersonation, fraud, and consent materially increases misuse risk. Because this skill specifically enables rapid cloning from a short sample, the context makes the omission more dangerous: it lowers the barrier to creating deceptive audio using someone else's voice.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Broad trigger phrases like general requests to compose or sing can cause the skill to activate unexpectedly for common user intents. Because this skill involves voice cloning and likely file/network operations, accidental invocation could lead to unnecessary collection of sensitive audio or initiation of higher-risk workflows.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The alias list includes short and ambiguous names that overlap with ordinary conversation, increasing the chance of accidental or silent activation. In the context of a skill that processes biometric-like voice samples and may write files or call external services, misrouting a request has meaningful privacy and security consequences.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill centers on uploading voice samples for cloning, but it does not prominently warn users about consent, impersonation, retention, sharing, and biometric privacy risks. Voice cloning is especially sensitive because misuse can enable fraud, deception, or non-consensual impersonation, making the omission more dangerous in this context.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to upload voice recordings and configure callback delivery, but provides no privacy notice, retention policy, consent requirements, or guidance for handling biometric voice data. In this skill context, uploaded recordings are especially sensitive because they are used for voice cloning, which raises impersonation, consent, and downstream disclosure risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide describes speaker embedding extraction and voice cloning without any consent, identity, or biometric-data handling warning. Because voiceprints are sensitive biometric data and the skill's core purpose is cloning a user's voice for singing, omission of consent and privacy safeguards materially increases risk of impersonation, privacy abuse, and unauthorized biometric processing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The plugin-loading section documents scanning directories and executing discovered plugin files, but does not warn that plugins are arbitrary code with full runtime privileges. That omission is dangerous because developers may interpret plugins as benign extensions rather than untrusted executable code, leading to accidental installation of malicious or compromised components.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This skill processes highly sensitive biometric voice data, trains personalized voice-cloning models, stores those models long term, and monitors user activity, but the spec does not describe consent flows, retention limits for trained models, deletion rights, or safeguards against unauthorized impersonation. In a voice-cloning context, this omission materially increases the risk of privacy violations, non-consensual voice replication, account abuse, and regulatory noncompliance because biometric data and cloned voices can be misused far beyond the original song-generation purpose.

Missing User Warnings

Medium

• Confidence: 77% confidence
• Finding: The service stores raw job data in Redis, including user-supplied voice sample references and lyrical content, for 24 hours without any minimization, encryption, or evidence of consent handling. In a voice-cloning context, retaining biometric-adjacent audio inputs and personal creative content increases privacy and breach impact if Redis is exposed or accessed by unauthorized parties.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code uploads a user-provided voice sample to network services for preprocessing and voice-clone training without any visible consent check, disclosure, or trust boundary enforcement. Because voice data is highly sensitive biometric information and this skill explicitly performs voice cloning, silent transmission to backend services materially increases privacy, impersonation, and data-misuse risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script writes requirements.txt and, depending on invocation, also creates Docker and config artifacts without an explicit upfront confirmation or warning. This can unexpectedly overwrite local files or alter the workspace, which is unsafe operationally even if not a direct exploit primitive.

Unvalidated Output Injection

High

• Category: Output Handling

Content

# 检查运行中的容器
            try:
                ps_result = subprocess.run(['docker', 'ps', '--format', 'json'], 
                                         capture_output=True, text=True)
                if ps_result.returncode == 0:
                    # 解析 JSON 格式的容器列表

• Confidence: 72% confidence
• Finding: Container metadata from docker ps is untrusted external output and is surfaced into program state and reporting without sanitization. While the larger issue is over-broad host inventory, crafted container names/status strings could also inject misleading content into logs or terminals and amplify information disclosure.

Static analysis

No suspicious patterns detected.