← 返回 Skills 市场
MusicGenerator
作者
MakeBestMusic
· GitHub ↗
· v1.0.0
· MIT-0
226
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install musicgenerator
功能描述
AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator...
安全使用建议
This skill largely does what it claims: it sends your apiKey to MakebestMusic endpoints to start and check music generation. Before installing, consider the following:
- The code accepts an undocumented MBM_API_BASE env var which, if set, will redirect API calls to a different domain. Ask the publisher to declare or remove this override. Do not set MBM_API_BASE unless you control and trust the target host.
- Use a dedicated/limited API key for this skill (not a high-privilege or multi-service secret). Rotate the key if you stop using the skill.
- Verify the API endpoint is the official https://api.makebestmusic.com (the script defaults to it). Confirm the domain and review MakebestMusic privacy/terms for generated lyrics/audio handling.
- The SKILL.md references a folder name text-to-music while registry slug is musicgenerator — check that paths work in your OpenClaw install before relying on the example commands.
- If you need stronger assurance, request the author to: (1) document MBM_API_BASE in SKILL.md or remove the override, (2) rename apiKey to something vendor-scoped in metadata, and (3) confirm there are no other telemetry or logging endpoints.
I have medium confidence because the code is small and mostly consistent, but the undocumented endpoint override is a real risk vector and justifies extra caution.
功能分析
Type: OpenClaw Skill
Name: musicgenerator
Version: 1.0.0
The skill bundle contains a shell injection vulnerability within its operational instructions. The `SKILL.md` file directs the AI agent to execute shell commands (`node ... "<prompt>"`) using unsanitized user input, which could allow an attacker to execute arbitrary code on the host system if the agent fails to properly escape the input. While the scripts `generate.js` and `query.js` appear to legitimately interact with the `makebestmusic.com` API using the user's provided `apiKey`, the instruction pattern itself constitutes a high-risk vulnerability.
能力评估
Purpose & Capability
Name, description, SKILL.md, and the two scripts are consistent with an AI music generation assistant that talks to MakebestMusic. The only required secret is an apiKey which is appropriate for this purpose.
Instruction Scope
SKILL.md instructs running the included node scripts and shows expected outputs, which is consistent. However the runtime code reads an undocumented environment variable MBM_API_BASE (defaulting to the official API). That undocumented override lets callers redirect network calls to an arbitrary endpoint without the user being informed in SKILL.md. Also the SKILL.md uses the skill folder name text-to-music while registry metadata uses slug musicgenerator — a minor mismatch in paths/naming that could cause confusion.
Install Mechanism
No install spec or external downloads — the skill is instruction-only with included JS scripts. No remote archive or package installs were found.
Credentials
Only one required env var (apiKey) is declared and used, which matches the skill purpose. However the code also reads MBM_API_BASE (not declared in SKILL.md/metadata) which can change the target endpoint. The primary credential name is generic (apiKey) but SKILL.md explains it should be the MakebestMusic/Claw key.
Persistence & Privilege
always is false and the skill does not request system-wide changes or persistent privileges. It only runs short-lived node processes; no indication it modifies other skills or agent configs.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install musicgenerator - 安装完成后，直接呼叫该 Skill 的名称或使用
/musicgenerator触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
AI music generation assistant for custom songs and audio tracks.
- Added comprehensive skill documentation, including usage, setup, and troubleshooting.
- Provides clear steps for obtaining and configuring the required API key.
- Details example requests for creating songs with or without vocals.
- Explains command usage for generating music and checking status.
- Describes expected response formats and status handling for music tasks.
元数据
常见问题
MusicGenerator 是什么？
AI music generation assistant powered by MakebestMusic. Use when user wants to create AI-generated music, songs, or audio tracks. Perfect for content creator... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 226 次。
如何安装 MusicGenerator？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install musicgenerator」即可一键安装，无需额外配置。
MusicGenerator 是免费的吗？
是的，MusicGenerator 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
MusicGenerator 支持哪些平台？
MusicGenerator 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 MusicGenerator？
由 MakeBestMusic（@sthk-mbm）开发并维护，当前版本 v1.0.0。
推荐 Skills