Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.mjs:32
- Evidence
const value = process.env[name] ?? localEnv[name] ?? fallback;
Security audit
Suno Music
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Suno music plugin that uses a Suno API key, sends song content to the provider, and keeps local history, with privacy cautions but no evidence of deception or malware.
Install only if you are comfortable sending prompts, lyrics, callback details, and generated-song metadata to your configured Suno API provider. Use a trusted SUNO_BASE_URL, keep the .env file private, avoid sensitive lyrics or prompts, and treat the optional callback server as a local debugging tool unless you add body-size limits and safer logging.
Static analysis
Detected: suspicious.env_credential_access