Security audit

Agent Radio

Security checks for vulnerabilities and agentic risk

Overview

This radio skill is mostly coherent, but its playback controls can signal a persisted PID without verifying it still belongs to the player process.

Review this before installing if you run important long-lived processes in the same user account. The skill should be safer if it validates the stored player process before sending signals and documents that radio searches contact the external Radio Browser API.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/radio.sh:65
Finding: Unvalidated Persisted PID Allows Signaling of Unrelated Processes
Content: View full analysis
/dev/null } ``` ```bash stop_playback() { refresh_prefs if pid_is_running "$current_pid"; then kill "$current_pid" 2>/dev/null || true wait "$current_pid" 2>/dev/null || true fi prefs_json="$(jq '.current_pid = null | .paused = false' <<< "$prefs_json")" persist_prefs } ``` ```bash cmd_pause() { local signal state refresh_prefs if ! pid_is_running "$current_pid"; then prefs_json="$(jq '.current_pid = null | .paused = false' <<< "$prefs_json")" persist_prefs echo "Nothing playing." return 0 fi if [[ "$paused" == "true" ]]; then signal="CONT" state="resumed" prefs_json="$(jq '.paused = false' <<< "$prefs_json")" else signal="STOP" state="paused" prefs_json="$(jq '.paused = true' <<< "$prefs_json")" fi kill "-SIG$signal" "$current_pid" 2>/dev/null || { echo "Pause/resume is not supported for the current player on this platform." return 1 } persist_prefs echo "Playback $state." } ``` ### Technical Analysis The skill stores the media player's process ID in `preferences.json` and later trusts that value when stopping, pausing, or resuming playback. The `pid_is_running` function only uses `kill -0` to determine whether any process currently has that PID. It does not establish that the process is the `mpv` or `ffplay` instance originally launched by the skill. Process IDs are reused by operating systems. If the player exits without the preferences being updated, the saved PID can subsequently be assigned to an unrelated process. The next `stop`, `pause`, or `play` operation can then send `TERM`, `STOP`, or `CONT` to that process. Th ...[truncated 1987 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents a live station search feature using curl but does not clearly warn that user search terms are transmitted to an external Radio Browser service. This creates a privacy/transparency issue because users may unknowingly send potentially sensitive listening interests or identifiers off-host, especially when the skill is invoked through an assistant rather than directly via the terminal.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The find command sends the user-provided search query to a third-party radio-browser API over the network, but the script's usage text and comments do not clearly disclose that this command performs an external lookup. While the transmission is over HTTPS and the query is not especially sensitive in normal use, undisclosed network transmission can expose user interests or habits and may surprise users in privacy-sensitive environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.