Skills/ClawHub/music-with-comfyui

music-with-comfyui@0.4.13

VERIFIED

Publisher claims: "Use to generate music and audio through a user-defined ComfyUI server (COMFYUI_URL env var or comfyui_url in config.json; if no server is reachable the script exits with configuration instructions) — trigger with requests like "make me a song", "make up a song", "compose", "write a song", "compose a track", "arrange a song", "编一个歌", "写歌", "作曲", "编个曲", "做首歌", or any similar instruction to write/compose/arrange a song or melody (in any language). **Important disambiguation: in Chinese, "写歌" / "写一个歌" / "来个歌" here means *generate an actual audio song through ComfyUI* (AceStep 1.5 → MP3), NOT merely writing lyrics text.** If you only want lyrics written down (words, no audio), that is plain text writing and NOT this skill. Not for simple audio file conversion, volume adjustment, or transcribing/normalizing an existing audio file (that is plain audio processing, not generation). The model is **AceStep Audio 1.5** — it turns a music-description (style/genre tags) plus optional lyrics into a generated MP3. You may specify any of theme, music length, style, lyrics — one or more; if the user gives an image, the style and/or lyrics can be derived from it. **Destructive cleanup disclosure:** after the local save succeeds the script **deletes the server-side copy of the generated audio** (`POST /purge_after_retrieval`) unless the user opts out with `--keep` / `COMFYUI_PURGE=0`; this removes remote files but only the generated audio of this run (AceStep 1.5 has no image input, so nothing the user uploaded is stored on the server). The agent should tell the user before running that the server-side copy is removed, and honor `--keep` if the user wants to retain it. This deletes only the server-side copy of the generated audio for this run; AceStep music runs upload no input materials, so there is nothing the user uploaded on the server to remove, and nothing else is touched." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher sunshinejnjn · joined 6 days agoInstalls 372Last detonated 38 h ago
$clawhub install music-with-comfyui
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-31 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
File type combined with upload actionSKILL.md:57 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionSKILL.md:3 · File type combined with upload action — agent may exfiltrate local data filesFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07