sonoscli

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:24 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Sonos speaker-control skill, with expected physical-device effects and a mutable third-party CLI install that users should understand first.

Install only if you intend to let the agent control Sonos speakers on your local network. Confirm speaker names or IPs before playback, volume, grouping, party, solo, queue clear, or favorite-open commands, and prefer a pinned/reviewed sonoscli version if reproducible installation matters. Provide Spotify credentials only when you need Spotify search.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Go Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

text

metadata: {"clawdbot":{"emoji":"🔊","requires":{"bins":["sonos"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/sonoscli/cmd/sonos@latest","bins":["sonos"],"label":"Install sonoscli (go)"}]}}

Technical Analysis

The installation metadata directs the host to build and install github.com/steipete/sonoscli/cmd/sonos@latest. The mutable @latest selector does not identify a specific reviewed release or commit. Consequently, the source code installed later may differ from the code that was available when this Skill was audited.

The module path is consistent with the declared Sonos command-line tool, and the reviewed files contain no evidence of typosquatting or an intentionally malicious dependency. Nevertheless, relying on a mutable upstream revision creates a supply-chain risk. A compromised upstream repository, maintainer account, newly published release, or transitive dependency could cause future installations to compile attacker-controlled code.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, the release process, or a dependency incorporated by a future upstream revision.
2. The attacker publishes or causes Go tooling to select a malicious revision as the current latest version.
3. A user or agent installs this Skill after that change.
4. The installation mechanism resolves github.com/steipete/sonoscli/cmd/sonos@latest rather than a previously reviewed immutable revision.
5. Go downloads and compiles the altered module and its transitive dependencies.
6. When the agent invokes the installed sonos binary, the malicious code executes with the privileges and environmental access of that process.

Impact Assessment

Successful exploitation could permit arbitrary behavior under the installing or executing us ...[truncated 419 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, explicit semantic version or immutable commit identifier.
2. Record and review the exact selected module version and all transitive dependencies before publishing the Skill.
3. Retain Go module checksum verification and ensure the trusted checksum database or an approved internal equivalent is used.
4. Generate a software bill of materials or dependency lock record for reproducible review and installation.
5. Introduce automated dependency scanning and provenance verification in the release process.
6. Update the pinned revision only through a controlled process that reviews upstream changes, validates checksums, and tests the resulting binary before release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill enables discovery and control of Sonos devices on the local network, but the description and usage text do not warn users that commands can affect real devices in their environment. This can lead to unintended playback, volume changes, or grouping actions on household or office speakers, especially if the user does not realize the skill performs active network-device control.

Content

No source excerpt is available for this finding.