How to prove that a encryption scheme is not IND-CPA secure
In IND-CPA experiment, can the adversary generate a key (that may not be real secret key) and compute Enc(key, message)?


Yes, for message available to the adversary per the rules of the game. The adversary is always assumed to be able to use as a subprogram the algorithm under attack, or any part of it (e.g. encryption, or decryption, or key generation as is the case here; or any deterministic internal block, such as a hash including when modeled as a random oracle). That's per Kerckhoffs's principle. The computation is still counted as work performed by the adversary.

The random inputs and the outputs of any internal TRNG of the scheme under attack are assumed to be supplied to the adversary only inasmuch as prescribed by the scheme (e.g. IV for encryption; that's uncommon for key generation). The adversary has unlimited randomness available (e.g. to generate new keys, collisions), except if it is explicitly specified to be deterministic.