Suno Claw

基于 Suno AI 的多轮迭代创作流程，生成符合 Suno 标准的高质量带歌词或纯音乐作品。

This skill is largely what it says (a Suno/kie.ai music-generation workflow), but take the following precautions before installing: - Expect to provide a KIEAI_API_KEY: SKILL.md and the scripts require this env var, but the registry metadata omitted it. Confirm the platform will supply this secret and that the developer updates the manifest. - Do not set CALLBACK_URL to an unknown third-party endpoint. If you want callbacks, use an internal/trusted endpoint or leave CALLBACK_URL empty (the scripts default to polling rather than sending callbacks). - Ensure your OpenClaw environment provides Python and the requests library (the included scripts call requests) or run the scripts in a sandboxed environment. - Be aware the skill stores user-generated lyrics and preference signals locally at suno-claw/memory/ (history.json and patterns.log). If you want to remove stored data, delete that directory. - The docs contain minor inconsistencies (e.g., generator.md mentions a default example callback URL, while the script only sends a callback if CALLBACK_URL is non-empty). Ask the author to clarify and to update the registry metadata to list required env vars and any runtime dependencies before you proceed. If you need to be extra cautious, review the included Python scripts (they are short and call only the advertised kie.ai endpoints) and test the skill in an isolated environment first.

Type: OpenClaw Skill Name: suno-claw Version: 1.0.6 The suno-claw skill bundle implements a multi-agent workflow for music generation via the Suno AI (kie.ai API). While the code appears to be a legitimate tool, it is classified as suspicious due to the presence of high-risk capabilities and potential vulnerabilities. Specifically, the orchestrator (executor-main.md) instructs the AI agent to execute shell commands (e.g., `python scripts/suno_generate.py`) using strings generated by sub-agents without sufficient sanitization for shell metacharacters, creating a risk of shell injection (RCE). Additionally, the skill requires external network access to api.kie.ai and performs local file writes to maintain a memory system (history.json, patterns.log), which are considered risky capabilities under the evaluation criteria even when aligned with the stated purpose.