← Back to Skills Marketplace
MusicGenerator
by
MakeBestMusic
· GitHub ↗
· v1.0.0
· MIT-0
226
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install musicgenerator
Description
AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator...
Usage Guidance
This skill largely does what it claims: it sends your apiKey to MakebestMusic endpoints to start and check music generation. Before installing, consider the following:
- The code accepts an undocumented MBM_API_BASE env var which, if set, will redirect API calls to a different domain. Ask the publisher to declare or remove this override. Do not set MBM_API_BASE unless you control and trust the target host.
- Use a dedicated/limited API key for this skill (not a high-privilege or multi-service secret). Rotate the key if you stop using the skill.
- Verify the API endpoint is the official https://api.makebestmusic.com (the script defaults to it). Confirm the domain and review MakebestMusic privacy/terms for generated lyrics/audio handling.
- The SKILL.md references a folder name text-to-music while registry slug is musicgenerator — check that paths work in your OpenClaw install before relying on the example commands.
- If you need stronger assurance, request the author to: (1) document MBM_API_BASE in SKILL.md or remove the override, (2) rename apiKey to something vendor-scoped in metadata, and (3) confirm there are no other telemetry or logging endpoints.
I have medium confidence because the code is small and mostly consistent, but the undocumented endpoint override is a real risk vector and justifies extra caution.
Capability Analysis
Type: OpenClaw Skill
Name: musicgenerator
Version: 1.0.0
The skill bundle contains a shell injection vulnerability within its operational instructions. The `SKILL.md` file directs the AI agent to execute shell commands (`node ... "<prompt>"`) using unsanitized user input, which could allow an attacker to execute arbitrary code on the host system if the agent fails to properly escape the input. While the scripts `generate.js` and `query.js` appear to legitimately interact with the `makebestmusic.com` API using the user's provided `apiKey`, the instruction pattern itself constitutes a high-risk vulnerability.
Capability Assessment
Purpose & Capability
Name, description, SKILL.md, and the two scripts are consistent with an AI music generation assistant that talks to MakebestMusic. The only required secret is an apiKey which is appropriate for this purpose.
Instruction Scope
SKILL.md instructs running the included node scripts and shows expected outputs, which is consistent. However the runtime code reads an undocumented environment variable MBM_API_BASE (defaulting to the official API). That undocumented override lets callers redirect network calls to an arbitrary endpoint without the user being informed in SKILL.md. Also the SKILL.md uses the skill folder name text-to-music while registry metadata uses slug musicgenerator — a minor mismatch in paths/naming that could cause confusion.
Install Mechanism
No install spec or external downloads — the skill is instruction-only with included JS scripts. No remote archive or package installs were found.
Credentials
Only one required env var (apiKey) is declared and used, which matches the skill purpose. However the code also reads MBM_API_BASE (not declared in SKILL.md/metadata) which can change the target endpoint. The primary credential name is generic (apiKey) but SKILL.md explains it should be the MakebestMusic/Claw key.
Persistence & Privilege
always is false and the skill does not request system-wide changes or persistent privileges. It only runs short-lived node processes; no indication it modifies other skills or agent configs.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install musicgenerator - After installation, invoke the skill by name or use
/musicgenerator - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
AI music generation assistant for custom songs and audio tracks.
- Added comprehensive skill documentation, including usage, setup, and troubleshooting.
- Provides clear steps for obtaining and configuring the required API key.
- Details example requests for creating songs with or without vocals.
- Explains command usage for generating music and checking status.
- Describes expected response formats and status handling for music tasks.
Metadata
Frequently Asked Questions
What is MusicGenerator?
AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator... It is an AI Agent Skill for Claude Code / OpenClaw, with 226 downloads so far.
How do I install MusicGenerator?
Run "/install musicgenerator" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is MusicGenerator free?
Yes, MusicGenerator is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does MusicGenerator support?
MusicGenerator is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created MusicGenerator?
It is built and maintained by MakeBestMusic (@sthk-mbm); the current version is v1.0.0.
More Skills