Skills/skills.sh/ace-step

ace-step@r1

VERIFIED

Publisher claims: "Generate, inpaint, and outpaint music with ACE Step on RunComfy via the `runcomfy` CLI. ACE Step is StepFun-AI's open-weights music foundation model — tag-driven composition (genre, mood, instruments), multilingual lyrics with section markers, 5 s to 4 min stereo output, $0.0002–0.0003 per second (≈ 27× cheaper than ElevenLabs Music). Four endpoints: ACE Step text-to-audio (the default), ACE Step 1.5 text-to-audio (50+ language lyrics, refined structured-lyric handling), ACE Step audio-inpaint (regenerate a time range inside an existing track), ACE Step audio-outpaint (extend an existing track before or after). Triggers on "ace step", "ace-step", "acestep", "ACE music", "open music model", "cheap AI music", "inpaint audio", "audio inpaint", "extend music", "audio outpaint", "lengthen track", "music with tags", or any explicit ask to generate or edit music with ACE Step. " Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry skills.shPublisher prime-skills · joined 2 days agoInstalls 367KLast detonated 39 h ago
$npx skills add ace-step
Report an issue

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

HIGH
npx invocation of non-well-known packageSKILL.md:33 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Prompt injection attemptSKILL.md:112 · Prompt injection attempt — model control tokens
AST01
CRITICAL
Prompt injection attemptSKILL.md:135 · Prompt injection attempt — model control tokens
AST01
HIGH
npx invocation of non-well-known packageSKILL.md:42 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Prompt injection attemptSKILL.md:173 · Prompt injection attempt — model control tokens
AST01
HIGH
npx invocation of non-well-known packageSKILL.md:321 · npx invocation of non-well-known package — may execute untrusted code
AST06
CRITICAL
Prompt injection attemptSKILL.md:98 · Prompt injection attempt — model control tokens
AST01
CRITICAL
Prompt injection attemptSKILL.md:157 · Prompt injection attempt — model control tokens
AST01