Suno Lyrics To Song

Lyrics to Song Skill

Overview

Turn full lyrics, a rough draft, or a hook into a structured song with clear sections, style, and vocal direction, from inside Claude Code, Codex, or OpenClaw. The work is produced on the hosted, paid Beatra service (mcp.beatra.ai).

This catalog entry is a reviewed pointer, not the executable package. It contains no client code and performs no Beatra operation by itself. The package it points to bundles three standard-library Python scripts that make network calls, store a credential, and can replace their own files. Read Install and Security & Safety Notes before activating it.

The archive holds regular files only (no symlinks, no executable bits, no binaries). Confirm that with the inspect commands below. Every file must be byte-identical to the source tree at the pinned commit.

When to Use This Skill

• Use when the user explicitly wants Lyrics to Song audio produced on Beatra and accepts that it is paid.
• Use when they have agreed to send lyrics, themes, or reference audio to a third party.
• Do not use for local DAW work or when no paid render was approved.

Install (pinned, verified, approved twice)

Step 1: Download and verify into a review directory

Explain that this downloads an external package from cdn.beatra.ai, then ask for approval. Only after approval:

umask 077
review_dir="$(mktemp -d)"
cd "$review_dir" || exit 1
curl -fsSLO "https://cdn.beatra.ai/agent-packages/suno-lyrics-to-song/v0.2.0/suno-lyrics-to-song-skill-0.2.0.zip"
printf '%s  %s\n' \
  'f264cbd8c426f2c88a75d80b94766187873965f3a7cea6e90a76e06539069a09' \
  'suno-lyrics-to-song-skill-0.2.0.zip' | shasum -a 256 -c -

Stop if the check does not print OK. The expected digest comes from this catalog entry, not from a file on the same CDN.

Step 2: Inspect before activation

unzip -l suno-lyrics-to-song-skill-0.2.0.zip
unzip -q suno-lyrics-to-song-skill-0.2.0.zip
find suno-lyrics-to-song -type l -print            # expect no output
find suno-lyrics-to-song -type f -perm -111 -print # expect no output
grep -n '"auto_update": True' suno-lyrics-to-song/scripts/mcp_client.py

Optionally confirm byte identity with the public source tree (a second, independent host):

git clone --quiet --filter=blob:none --no-checkout https://github.com/beatra-ai/lyrics-to-song-skill.git src
git -C src checkout --quiet 2facaacd68cee88a73847be8563895535c48cd47 -- skills/suno-lyrics-to-song
(cd suno-lyrics-to-song && find . -type f | LC_ALL=C sort | xargs shasum -a 256) > archive.sha
(cd src/skills/suno-lyrics-to-song && find . -type f | LC_ALL=C sort | xargs shasum -a 256) > tree.sha
cmp archive.sha tree.sha && echo IDENTICAL

Report to the user what the review found: SKILL.md, manifest.json, the bundled Markdown references, and scripts/authorize.py, scripts/mcp_client.py, scripts/uninstall.py (Python 3.10+, standard library only, no dependency installation, no lifecycle hooks). Summarize the network, credential, local-state, telemetry, and self-update behavior listed under Security & Safety Notes.

Step 3: Copy in and disable self-update before any other command

Ask for a second, separate approval, because this changes agent configuration. Then copy the reviewed tree to the host's skills directory (Claude Code shown; use the equivalent path for other hosts) and immediately turn off silent self-update for that exact path:

dest="$HOME/.claude/skills/suno-lyrics-to-song"
test ! -e "$dest" || { echo "destination exists; stop and ask the user"; exit 1; }
cp -R suno-lyrics-to-song "$dest"
python3 "$dest/scripts/mcp_client.py" update --auto off

The last command must print Automatic Beatra package updates are disabled. It writes only ~/.beatra/updates/<id>/state.json and makes no network request. Run it before authorize.py, verify, tools, upload, or call: in this pinned version self-update is on by default. The setting is keyed to the resolved install path, so repeat it after moving or re-copying the directory.

Step 4: Authorize as its own decision

Authorization opens a browser sign-in and stores a bearer token. Ask first.

python3 "$dest/scripts/authorize.py"

Start a new agent session if the host discovers skills only at startup.

How It Works

1. Read the installed package's SKILL.md and its references; they define the routes, payload shapes, and review loop.
2. Use free, non-billable discovery first (beatra.models.list, task list) to read current model cards and credit estimates.
3. Show the user a cost card for exactly one paid call: tool, model, estimate, and which files will be uploaded. Wait for explicit approval. Planning or "just do it" is not approval.
4. Upload only files the user supplied and approved for this task, then submit once with a stable client_request_id and poll the returned task.
5. Report the delivered artifact and billing.net_charged_credits, review the result with the user, and ask again before any further paid stage.

Examples

Free connection check (non-billable)

python3 "$HOME/.claude/skills/suno-lyrics-to-song/scripts/mcp_client.py" verify

One approved paid call

After the user approved the cost card for this exact payload, submit once with a stable request id using the tool name from the installed SKILL.md. If the response is lost, retry only with the same client_request_id and identical arguments; never submit a replacement while the task is running.

Update

This entry does not endorse the package's silent self-update. Keep update --auto off in place and do not run update --auto on or a bare update without explicit approval.

To move to a newer version, repeat Steps 1 to 3 for that version in a new review directory, verify its digest against the matching tree in beatra-ai/lyrics-to-song-skill (a version not listed in this entry has not been reviewed here), show the user the file-level changes against the installed copy, and replace the directory only after approval. update --check reports the available version from beatra.ai without changing files.

Uninstall

dest="$HOME/.claude/skills/suno-lyrics-to-song"
python3 "$dest/scripts/uninstall.py" --dry-run
python3 "$dest/scripts/uninstall.py"

Read the JSON decision. disconnected means this was the last Beatra skill on the device: the token was revoked (when revoked is true) and the files credentials.json, installation.json, host.json, skills.json, and registrations.json under ~/.beatra were removed. keep_connection means another Beatra skill still uses the shared token, which stays. Then, after confirming the path with the user, delete $dest.

uninstall.py does not remove ~/.beatra/updates/. When the decision is disconnected and no other Beatra skill is installed, remove that directory too; otherwise leave it. A token that could not be revoked expires after 15 days idle and can be revoked at once in the Beatra Console under Agents.