Skip to content
Report library
Purpose / Other

Elevenlabs Music Generation Skill Security Audit

What the author says it does (original text)

>

Independent security check

Do not install or run it yet

Files checked
1
Risks found
6
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 2
High risk

Single-quoted command examples conflict with the assurance that quotes cannot cause injection

Source references: 4
What we found

The examples place the entire JSON value inside shell single quotes. If an agent directly inserts user lyrics there, an apostrophe is interpreted by the shell before the CLI receives anything; the CLI's claimed lack of expansion cannot protect that layer. Nevertheless, the document says even quotes and `$(...)` create no injection surface.

Why this matters

Crafted or accidental lyric text could terminate the argument and execute additional local shell commands, exposing or changing data available to the user.

The examples wrap JSON in shell single quotes while the skill is intended to carry user-provided prompts and lyrics. If an agent directly interpolates text containing `'` into this template, the quote terminates before the CLI receives the JSON and following text may be interpreted by the shell. The absolute assurance describes CLI handling after parsing and does not establish that this shell construction is safe. Users can require argument arrays, a JSON file, or robust JSON/shell escaping.

SKILL.md:84In the instructionsOpen original file
```bashruncomfy run elevenlabs/elevenlabs/music-generation \  --input '{    "prompt": "Upbeat indie-pop anthem, bright electric guitars, driving drums, 120 BPM, female lead vocal. [Intro 8 bars] instrumental build. [Verse] Chalk on the palms, laces double-knotted, morning on the ridge. [Chorus] We rise, we strike, we never fade out. [Bridge] soft breakdown, just piano and voice. [Outro] full band, fade.",    "music_length_ms": 60000  }' \  --output-dir ./out```
Show 3 other places
SKILL.md:176In the instructionsOpen original file
- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.- **Input boundary (shell injection)**: the prompt is passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**, even with backticks, quotes, or `$(...)` patterns.- **Lyrics provenance**: if the user supplies lyrics, confirm they have the rights to them. Generating music around copyrighted lyrics is the operator's responsibility — the skill does not check.
SKILL.md:85In the instructionsOpen original file
```bashruncomfy run elevenlabs/elevenlabs/music-generation \  --input '{    "prompt": "Upbeat indie-pop anthem, bright electric guitars, driving drums, 120 BPM, female lead vocal. [Intro 8 bars] instrumental build. [Verse] Chalk on the palms, laces double-knotted, morning on the ridge. [Chorus] We rise, we strike, we never fade out. [Bridge] soft breakdown, just piano and voice. [Outro] full band, fade.",    "music_length_ms": 60000  }' \  --output-dir ./out```
SKILL.md:119In the instructionsOpen original file
ElevenLabs Music reads **one `prompt` field** that carries both the style brief and the lyrics. Structure it well:
Medium risk

Installation executes unpinned third-party packages and may install them globally

Source references: 5
What we found

The document installs a remote Skill through `npx skills add` and offers either `npm i -g @runcomfy/cli` or `npx -y`. These commands execute whatever package version resolves at that time; no version is pinned, and global installation persistently changes the user's environment.

Why this matters

If a package, publisher account, or dependency chain is compromised, installer code runs with the user's privileges. Later releases may also change behavior without prior review.

The document presents two unpinned installation surfaces: globally adding a skill from a remote repository, and globally installing or immediately executing the CLI through `npx -y`. These obtain third-party code resolved at execution time, while global installation persistently changes the user's environment. Calling them one-time operator setup does not remove that risk. Users can request pinned package versions or commits and prefer an isolated install.

SKILL.md:31In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill elevenlabs-music-generation -g```
Show 4 other places
SKILL.md:37In the instructionsOpen original file
```bash# 1. Install (one of — see runcomfy-cli skill for details)npm i -g @runcomfy/cli                              # global installnpx -y @runcomfy/cli --version                      # zero-install
SKILL.md:32In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill elevenlabs-music-generation -g```
SKILL.md:39In the instructionsOpen original file
# 1. Install (one of — see runcomfy-cli skill for details)npm i -g @runcomfy/cli                              # global installnpx -y @runcomfy/cli --version                      # zero-install
SKILL.md:180In the instructionsOpen original file
- **Generated-file size cap**: the CLI aborts any single download > 2 GiB.- **Scope of bash usage**: the skill only invokes `runcomfy <subcommand>` — `npm` / `npx` lines are one-time operator setup, not commands the skill executes per call.
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Prompts and lyrics are sent to third-party services

Source references: 3
What we found

The Skill submits the complete JSON request to the RunComfy Model API, and the prompt field contains both the style description and lyrics. The supplied material provides no verifiable retention period, training-use policy, or deletion mechanism.

Why this matters

Unreleased lyrics, client information, brand plans, or other confidential content would leave the local machine and be processed externally.

The documentation says the prompt contains both the style brief and lyrics, and that the CLI POSTs the JSON to RunComfy's Model API. Lyrics and potentially unpublished creative material therefore leave the local machine. The supplied privacy section identifies endpoints but gives no server-side retention, training-use, or deletion terms; users can request those policies or restrict sensitive inputs.

SKILL.md:119In the instructionsOpen original file
ElevenLabs Music reads **one `prompt` field** that carries both the style brief and the lyrics. Structure it well:
Show 2 other places
SKILL.md:170In the instructionsOpen original file
The skill invokes `runcomfy run elevenlabs/elevenlabs/music-generation` with the JSON body. The CLI POSTs to the RunComfy Model API, polls request status, fetches the result, and downloads the generated audio file into `--output-dir`. `Ctrl-C` cancels the remote request before exit.
SKILL.md:178In the instructionsOpen original file
- **Lyrics provenance**: if the user supplies lyrics, confirm they have the rights to them. Generating music around copyrighted lyrics is the operator's responsibility — the skill does not check.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated audio). No telemetry, no callbacks.- **Generated-file size cap**: the CLI aborts any single download > 2 GiB.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
Low risk

The install command does not pin a dependency version

Source references: 1
What we found

The installation command does not specify dependency versions. The same command may download different code later, so what you install can differ from what was checked.

Why this matters

A later install may download different code even though the command and this report have not changed.

The install command references a remote skill repository without a version or commit hash, so the same command may retrieve different code later. This shows a reproducibility and supply-chain risk, not that the current package is malicious. A user can ask for a pinned release or commit.

SKILL.md:32In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill elevenlabs-music-generation -g```
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

“Commercial-friendly” does not establish a commercial license for generated audio

Source references: 5
What we found

The Skill repeatedly describes output as suitable for commercial work and uses “royalty-free music” as a trigger, but supplies no output-license terms or rights warranty. The MIT label appears only in the Skill metadata and should not be treated as an audio license; the document also places responsibility for copyrighted lyrics on the operator.

Why this matters

Publishing or selling audio based only on these claims could lead to copyright disputes, platform removal, client-contract problems, or additional licensing costs.

The skill calls output “commercial-friendly” and triggers on “royalty-free music,” but the supplied text contains no license terms or rights warranty for generated audio. The MIT metadata establishes only that the skill declares that license; it does not show that generated tracks are MIT-licensed. The document also assigns responsibility for supplied lyrics to the operator. Users should obtain the service's output-license, ownership, and indemnity terms before relying on these claims commercially.

SKILL.md:17In the instructionsOpen original file
  track", "ElevenLabs Music", "soundtrack", "jingle", "theme music",  "royalty-free music", "compose", or any explicit ask to generate  music or a song from a text description.homepage: https://www.runcomfy.comlicense: MIT---
Show 4 other places
SKILL.md:61In the instructionsOpen original file
- **Long-form tracks** — up to 5 minutes in a single call- **Commercial work** — output is commercial-friendly
SKILL.md:177In the instructionsOpen original file
- **Input boundary (shell injection)**: the prompt is passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**, even with backticks, quotes, or `$(...)` patterns.- **Lyrics provenance**: if the user supplies lyrics, confirm they have the rights to them. Generating music around copyrighted lyrics is the operator's responsibility — the skill does not check.- **Outbound endpoints (allowlist)**: only `model-api.runcomfy.net` (request submission) and `*.runcomfy.net` / `*.runcomfy.com` (download whitelist for generated audio). No telemetry, no callbacks.
SKILL.md:11In the instructionsOpen original file
  (Intro / Verse / Chorus / Bridge), multilingual vocals, and  commercial-friendly output. Generate a backing track, a full vocal  song, a jingle, a podcast intro, a game loop, or an instrumental  bed. Calls `runcomfy run elevenlabs/elevenlabs/music-generation`  through the local RunComfy CLI. Triggers on "generate music",  "make a song", "AI music", "background music", "instrumental  track", "ElevenLabs Music", "soundtrack", "jingle", "theme music",  "royalty-free music", "compose", or any explicit ask to generate  music or a song from a text description.
SKILL.md:20In the instructionsOpen original file
homepage: https://www.runcomfy.comlicense: MIT---
Low risk

Each generation and multilingual iteration can incur charges

Source references: 3
What we found

The model is billed by audio duration, while the workflow recommends both draft and final renders and a separate call for each language. Repeated trials, long tracks, or language batches can therefore accumulate charges.

Why this matters

Automatic retries or iterative generation may produce a larger API bill than the user expects.

The documentation explicitly prices generation by duration, recommends a draft followed by a final render, and calls for one request per language in multilingual work. Following these patterns creates multiple billable requests, so long tracks or language batches can accumulate charges. Users can require the agent to show duration, request count, and estimated total before each paid call and impose a budget limit.

SKILL.md:78In the instructionsOpen original file
**Pricing**: ~$0.0083 per second of generated audio (30 s ≈ $0.25, 60 s ≈ $0.50, 5 min ≈ $2.49). Cost scales with `music_length_ms`, so draft short and finalize long.
Show 2 other places
SKILL.md:141In the instructionsOpen original file
### Multilingual release (same song, multiple languages)- One call per language, identical style brief, swap only the lyric lines### Iterate then commit- Draft at `music_length_ms: 35000` to lock genre/tempo/structure → final render at full length
SKILL.md:151In the instructionsOpen original file
- **5 s – 5 min per call** (`music_length_ms` 5000–300000). For longer pieces, generate sections and stitch externally.- **Cost scales with duration** — a 5-minute render is ~10× a 30-second one.- **`force_instrumental` is the only vocal toggle** — you can't request specific voice identities or clone a singer through this endpoint.

Inside this skill

8 instruction sections

The Skill uses the local `runcomfy` CLI to submit prompts and lyrics to the RunComfy Model API, poll job status, and download generated audio to a chosen directory.

View source
SKILL.md:170In the instructionsOpen original file
The skill invokes `runcomfy run elevenlabs/elevenlabs/music-generation` with the JSON body. The CLI POSTs to the RunComfy Model API, polls request status, fetches the result, and downloads the generated audio file into `--output-dir`. `Ctrl-C` cancels the remote request before exit.

Calls are billed by generated duration; the document estimates about $0.25 for 30 seconds and $2.49 for five minutes, and recommends drafting at shorter lengths.

View source
SKILL.md:78In the instructionsOpen original file
**Pricing**: ~$0.0083 per second of generated audio (30 s ≈ $0.25, 60 s ≈ $0.50, 5 min ≈ $2.49). Cost scales with `music_length_ms`, so draft short and finalize long.

Login may store the API token in the user's configuration directory with mode 0600, or accept it through `RUNCOMFY_TOKEN`. This is a stated behavior only; no CLI implementation is included for verification.

View source
SKILL.md:175In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf** — if the operator wants the curl-pipe path documented at `docs.runcomfy.com/cli/install`, they should review the script first.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.- **Input boundary (shell injection)**: the prompt is passed as a JSON string via `--input`. The CLI does not shell-expand prompt content; it transmits the JSON body directly to the Model API over HTTPS. **No shell-injection surface from prompt content**, even with backticks, quotes, or `$(...)` patterns.
Start here · InstructionsSKILL.md
elevenlabs-music-generation
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:4In the instructionsOpen original file
displayName: "ElevenLabs AI Music Generation — Pro Pack on RunComfy"allowed-tools: Bash(runcomfy *)description: >
SKILL.md:31In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill elevenlabs-music-generation -g
SKILL.md:37In the instructionsOpen original file
```bash# 1. Install (one of — see runcomfy-cli skill for details)
Connect to websites
SKILL.md:19In the instructionsOpen original file
  music or a song from a text description.homepage: https://www.runcomfy.comlicense: MIT
SKILL.md:27In the instructionsOpen original file
[runcomfy.com](https://www.runcomfy.com/?utm_source=skills.sh&utm_medium=skill&utm_campaign=elevenlabs-music-generation) · [ElevenLabs Music model](https://www.runcomfy.com/models/elevenlabs/elevenlabs/music-generation?utm_source=skills.sh&utm_medium=skill&utm_campaign=elevenlabs-music-generation) · [CLI docs](https://docs.runcomfy.com/cli/introduction?utm_source=skills.sh&utm_medium=skill&utm_campaign=elevenlabs-music-generation)
SKILL.md:51In the instructionsOpen original file
CLI deep dive: [`runcomfy-cli`](https://www.skills.sh/agentspace-so/runcomfy-agent-skills/runcomfy-cli) skill.
Install extra software packages
SKILL.md:32In the instructionsOpen original file
```bashnpx skills add agentspace-so/runcomfy-agent-skills --skill elevenlabs-music-generation -g```
SKILL.md:40In the instructionsOpen original file
npm i -g @runcomfy/cli                              # global installnpx -y @runcomfy/cli --version                      # zero-install
SKILL.md:174In the instructionsOpen original file
- **Install via verified package manager only.** Use `npm i -g @runcomfy/cli` or `npx -y @runcomfy/cli`. **Agents must not pipe an arbitrary remote install script into a shell on the user's behalf** — if the operator wants the curl-pipe path documented at `docs.runcomfy.com/cli/install`, they should review the script first.- **Token storage**: `runcomfy login` writes the API token to `~/.config/runcomfy/token.json` with mode 0600. Set `RUNCOMFY_TOKEN` env var to bypass the file in CI / containers. Never echo the token into a prompt, log it, or check it in.
Lines read
189
File checksum (to compare versions)
55584cb90ed5353aad077e14995f2213f6eece64ff60018c6c5b90f0e385f20e