← Back to Skills Marketplace
324
Downloads
0
Stars
1
Active Installs
1
Versions
Install in OpenClaw
/install suno-ai
Description
Generate music via Suno with the local browser-backed flow. Use when the user wants Suno songs, instrumental tracks, lyric-based songs, Suno credit checks, o...
Usage Guidance
This skill implements a local browser-backed Suno automation that will access and persist your Suno session cookies/JWTs and can read your Chromium cookie DB (it even contains code to decrypt encrypted cookie values). It also can use an OpenRouter API key (from env or ~/.openclaw/.env) to perform hCaptcha solving via an external model — but the skill metadata does not declare this required credential. Before installing: (1) review the code yourself (or have a trusted developer do so), especially browser_session.py and openrouter_provider.py; (2) be comfortable that the skill will read browser cookies and write tokens/logs to ~/.suno; (3) if you do not want your local browser cookies read, do not run this skill or run it in an isolated VM/container; (4) if you provide an OpenRouter key, recognize it may be used to solve captchas and will incur remote model usage; (5) consider setting SUNO_PYTHON_BIN to a dedicated virtualenv and inspect ~/.openclaw/.env for secrets before running. The behavior is consistent with its stated purpose but contains sensitive operations and undeclared credential usage — exercise caution.
Capability Analysis
Type: OpenClaw Skill
Name: suno-ai
Version: 1.0.0
The skill performs high-risk operations including reading and decrypting the local Chromium cookie database (~/snap/chromium/common/chromium/Default/Cookies) and running a local HTTP server (127.0.0.1:8765) to receive authentication tokens. While these capabilities are documented in SKILL.md as part of a 'browser-backed flow' for Suno AI session recovery and hCaptcha solving, they represent a significant attack surface. The code in browser_session.py specifically implements Chromium cookie decryption using hardcoded fallback credentials (peanuts/saltysalt), and openrouter_provider.py patches external libraries to solve captchas via vision models. No clear evidence of intentional data exfiltration beyond the stated purpose was found, but the level of access to sensitive browser data warrants a suspicious classification.
Capability Assessment
Purpose & Capability
The skill's name/description (Suno music generation, session recovery, credit checks) align with the included code: browser automation, cookie import/validation, and generation flows. However the code also reads a live Chromium Cookies DB, decrypts cookies, and can import cookies from a local HTTP receiver — capabilities that go beyond simple 'call Suno API' behavior. The skill does not declare any required environment variables but clearly expects an OpenRouter API key (OPENROUTER_API_KEY / OPENCLAW_OPENROUTER_API_KEY) and may read ~/.openclaw/.env; that mismatch is noteworthy.
Instruction Scope
SKILL.md directs running local scripts and references paths under ~/.suno (venv, chrome profile, cookie files). The implementation will: read/save normalized cookie headers, import raw cookie JSON, copy and read the Chromium cookie SQLite DB (snap/chromium path), decrypt encrypted cookies, launch a persistent Playwright browser profile, run a local HTTP server to receive cookies, and call Suno endpoints. Those actions involve accessing sensitive local browser artifacts and persisting JWTs/cookies to ~/.suno. The SKILL.md mentions a local cookie receiver and exporting cookies but does not mention the Chromium DB export/decrypt capability or the optional external model service used for hCaptcha solving.
Install Mechanism
No install spec — instruction-only plus bundled Python scripts. Nothing in the manifest downloads remote archives during install. The runtime will rely on a Python virtualenv (~/.suno/venv) and Playwright; the code itself will be written to disk as part of the skill bundle, which is expected for a skill with code files.
Credentials
No required env vars are declared, but the code reads environment variables and files: it looks for OPENROUTER_API_KEY or OPENCLAW_OPENROUTER_API_KEY (and also checks ~/.openclaw/.env), and the helper scripts honor SUNO_PYTHON_BIN. The OpenRouter key is used to patch an hCaptcha challenger to solve image tiles via an external model provider — this is a privileged credential that the metadata does not declare. The skill also writes sensitive artifacts (normalized cookie header, raw cookies, JWT-derived tokens, debug logs) under ~/.suno.
Persistence & Privilege
always is false and the skill does not request forced global inclusion. It persists session artifacts and a browser profile under ~/.suno, which is consistent with its purpose. The skill does not appear to modify other skills or system-wide agent settings in the files shown.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install suno-ai - After installation, invoke the skill by name or use
/suno-ai - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial publish
Metadata
Frequently Asked Questions
What is Suno AI?
Generate music via Suno with the local browser-backed flow. Use when the user wants Suno songs, instrumental tracks, lyric-based songs, Suno credit checks, o... It is an AI Agent Skill for Claude Code / OpenClaw, with 324 downloads so far.
How do I install Suno AI?
Run "/install suno-ai" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Suno AI free?
Yes, Suno AI is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Suno AI support?
Suno AI is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Suno AI?
It is built and maintained by mySebbe (@mysebbe); the current version is v1.0.0.
More Skills