Apple Music DJ

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 11:54 PM UTC
• Version: 3.4.1

Overview

This Apple Music skill is purpose-aligned and openly describes its token use, local cache, account-writing actions, and opt-in automation.

Install only if you are comfortable giving the skill Apple Music developer and user tokens. Run token setup yourself, try the no-token demo first, review previews before enabling --create/--yes/--apply actions, and be especially deliberate before installing cron jobs because they can keep running until removed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is clearly related to Apple Music and does support part of the description: it accesses listening history and recommendations, searches the catalog, reads library/playlists, and performs account changes only after explicit confirmation via --yes. However, the declared purpose describes a much richer curator/analytics product with many specific user-facing features that are not present in this code chunk. Instead, the supplied code is primarily a general Apple Music API wrapper exposing low-level commands. It also includes write capabilities beyond playlist creation/editing, such as adding items to the library, setting favorites, and rating songs. Those actions are still Apple Music-related, so they are not unrelated, but they are stronger direct account-modification capabilities than the description emphasizes. Overall, the description materially overstates implemented behavior and the code's actual primary function is an API wrapper, not the full curator feature set claimed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code does match one narrow portion of the description: it modifies Apple Music playlists and requires explicit confirmation via --yes before making changes, which aligns with the claim that account changes are opt-in and confirmed first. However, the declared purpose presents a broad AI music curator with recommendation, discovery, analytics, compatibility, import, demo, and trend/radar features. This code chunk does none of that; it is only a low-level playlist management utility that takes precomputed song IDs and creates/adds/removes them. Additionally, it includes track removal from playlists, which is an account-changing/destructive capability not clearly represented in the description. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an end-user Apple Music curator focused on playlists, recommendations, listening statistics, and opt-in account modifications. The supplied code chunk does none of those user-facing music functions. Instead, it is a developer-facing authentication helper that reads environment variables and a private key file, signs a JWT, and outputs an Apple Music developer token. While token generation could be a supporting implementation detail for an Apple Music integration, this chunk’s primary purpose is authentication setup, which is materially different from the declared skill behavior and introduces capabilities/resources not described in the user-facing purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description presents a broad Apple Music curator with playlist generation, recommendations, imports, compatibility/blend features, and optional account modifications. The supplied code only implements listening-history analysis via three subcommands: timeline, streaks, and year-review. It reads a profile file and fetches Replay summary/milestone data using Apple Music tokens. The only clear overlap is the description’s claim about showing how taste changes over time and year-in-review style insights. However, the actual code’s primary purpose is much narrower than the declared skill, and several prominent declared capabilities are not represented here. Additionally, the description says a built-in demo needs no tokens, while this script requires APPLE_MUSIC_DEV_TOKEN and APPLE_MUSIC_USER_TOKEN, which is inconsistent with the declared access model.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad consumer-facing Apple Music recommendation and analytics skill centered on building playlists from listening history and providing discovery/statistics features. The supplied code instead implements a narrow maintenance script whose primary function is to scan library playlists for duplicates and unavailable tracks, then optionally remove duplicate copies and add replacement songs. While both relate to Apple Music playlists, the actual behavior is materially different from the declared purpose. The code also requires Apple Music tokens and has no built-in demo mode, and it does not implement the many declared recommendation, history-analysis, compatibility, import, or recurring curation capabilities. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a user-facing Apple Music curation and analytics skill with many music-related features such as playlist building, recommendation, taste analysis, imports, and optional account modifications. The supplied code chunk does not implement any of those primary behaviors. Instead, it is an auth/bootstrap utility whose purpose is to acquire and store Apple Music developer and user tokens via a localhost callback flow and token-status checks. While authentication can be a supporting component for the described skill, this chunk's actual behavior is materially different from the declared purpose and exposes undeclared credential-handling capabilities. Therefore this code chunk does not accurately represent the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description is partially accurate about the core Apple Music playlist features: the code genuinely supports deep cuts, mood/workout-style playlists, trending picks, similar songs/artists, decade throwbacks, two-person blends, and compatibility output. It also uses profile/listening-history-like inputs to personalize results. However, there are several material mismatches. Most importantly, the description explicitly advertises a demo that needs no tokens, while this code unconditionally calls require_env_tokens(), so tokenless demo behavior is not represented here. The description also lists a broad set of capabilities—taste evolution over time, taste card, year in review, catalog gaps, album deep dive, rabbit hole, concert prep, new release radar, Spotify import, weekly cron curation—that are not implemented in this code chunk. In addition, the code has account-writing capabilities (creating playlists, favoriting tracks, logging history, writing output files) despite declared permissions being empty, and it does not show an explicit confirmation interaction before such writes beyond requiring flags/subprocess calls. Because the advertised scope and permission model materially exceed or differ from the observed behavior, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad end-user Apple Music curator that builds playlists, recommendations, imports playlists, and offers many interactive music features. The supplied code does something narrower: it builds a taste-profile JSON from Apple Music API data and saves/cache/snapshots the result. That profiling behavior partially supports claims like 'shows how your taste changes over time' and 'listening stats/taste card/taste drift,' but the primary described experience is much broader than what this code actually implements. The most concrete mismatch is the description's claim of a built-in demo requiring no tokens, whereas this script explicitly requires APPLE_MUSIC_DEV_TOKEN and APPLE_MUSIC_USER_TOKEN. There are no undeclared suspicious capabilities beyond data collection/analysis and local file output, but the description materially overstates implemented functionality for this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

`verify_setup.sh` warn when the developer token is within 14 days of expiry or the user token is

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 671)May include surrounding context.

md

`verify_setup.sh` warn when the developer token is within 14 days of expiry or the user token is

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 713)May include surrounding context.

md

`verify_setup.sh` warn when the developer token is within 14 days of expiry or the user token is

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 676)May include surrounding context.

md

Apple credentials from the scripts it runs, and refuses `setup_cron.py` and paths into `~/.apple-music-dj/`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 695)May include surrounding context.

md

| `scripts/apple_music_api.sh` | Bash | API wrapper — all endpoints, retry logic |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 139)May include surrounding context.

Rate a Song

text

PUT    /v1/me/ratings/songs/{id}     body: {"type":"rating","attributes":{"value":1}}   (1 = love, -1 = dislike)
DELETE /v1/me/ratings/songs/{id}

Wrappers: apple_music_api.sh rate <id> <1|-1> --yes and unrate <id> --yes. Writes to the account (need --yes).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/troubleshooting.md (reported line 139)May include surrounding context.

Or remove just the cached profile (keeps your history, snapshots and config).

Ask before deleting — it's the user's data.

rm ~/.apple-music-dj/taste_profile.json

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/apple_music_api.sh (reported line 128)May include surrounding context.

sh

}

_with_auth() {
  # Usage: _with_auth <dev|both> <curl args...>
  # Runs _retry with a temporary auth config that is always removed afterwards.
  local mode="$1"; shift
  local cfg rc=0

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/demo.py (reported line 323)May include surrounding context.

python

def demo_env(api_url: str) -> dict:
    """The child's environment: real Apple credentials removed, demo ones and a sandbox HOME set."""
    env = {k: v for k, v in os.environ.items() if not k.startswith("APPLE_")}
    env.update({
        "HOME": str(DEMO_HOME),
        "APPLE_MUSIC_API_BASE": api_url,

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/apple_music_api.sh (reported line 51)May include surrounding context.

sh

if [[ -n "${_CURL_PID:-}" ]]; then
        kill "$_CURL_PID" 2>/dev/null || true
    fi
    rm -f "${TMPDIR:-/tmp}"/am_verify_$$_* 2>/dev/null || true
}
_CURL_PID=""
trap _cleanup EXIT

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/verify_setup.sh (reported line 27)May include surrounding context.

sh

if [[ -n "${_CURL_PID:-}" ]]; then
        kill "$_CURL_PID" 2>/dev/null || true
    fi
    rm -f "${TMPDIR:-/tmp}"/am_verify_$$_* 2>/dev/null || true
}
_CURL_PID=""
trap _cleanup EXIT

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/verify_setup.sh (reported line 34)May include surrounding context.

sh

trap '_cleanup; exit 130' INT
trap '_cleanup; exit 143' TERM

# _http_status <curl-config> <url> — sets HTTP_CODE ("000" on failure). curl runs in the
# background and we `wait` for it: bash defers traps until a foreground command finishes, so a
# plain `$(curl ...)` would ignore Ctrl-C/TERM until the request ended.
HTTP_CODE="000"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

bash

python3 scripts/import_playlist.py my-playlist.csv                          # preview, writes nothing
python3 scripts/import_playlist.py my-playlist.csv --create --name "From Spotify"

Tracks are matched by ISRC when your export has it, otherwise by a strict title + artist search;

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SECURITY.md (reported line 51)May include surrounding context.

md

2. **Keep `.env` in `.gitignore`** — The repo ships with this configured
3. **Rotate tokens periodically** — Dev tokens support up to 6-month lifetime
4. **Review cache contents** — `~/.apple-music-dj/` contains your taste profile
5. **Clear the cache when sharing machines** — list it first (`ls -la ~/.apple-music-dj`), then delete
   the folder yourself. It holds your taste profile, snapshots, playlist history and cron logs, and
   deleting it can't be undone. An agent should never do this without being asked.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 686)May include surrounding context.

md

2. **Keep `.env` in `.gitignore`** — The repo ships with this configured
3. **Rotate tokens periodically** — Dev tokens support up to 6-month lifetime
4. **Review cache contents** — `~/.apple-music-dj/` contains your taste profile
5. **Clear the cache when sharing machines** — list it first (`ls -la ~/.apple-music-dj`), then delete
   the folder yourself. It holds your taste profile, snapshots, playlist history and cron logs, and
   deleting it can't be undone. An agent should never do this without being asked.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of shell, network, environment-variable, and file read/write capabilities, but it does not declare any explicit tool scope or allowed-tools boundary. That creates a permission transparency gap: a host may grant broader capabilities than users expect, and reviewers cannot easily verify least-privilege constraints for a skill that handles tokens, local files, and account-modifying actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is extremely broad and includes ordinary phrases like 'DJ', 'mix', 'surprise me', and 'what should I listen to', which can cause the skill to activate during general conversation without clear user intent to invoke Apple Music account-linked actions. In a skill that can read listening history, access tokens, and potentially modify playlists or ratings, over-broad invocation increases the risk of unintended data access or unintended operational steps.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.