MusicPlaylistGen

• Outcome: Review
• Latest audit: May 28, 2026 · 1:05 PM UTC
• Version: 1.0.3

Overview

PlaylistGen appears to be a real music playlist tool, but it needs Review because it can expose a music library over the network and sends library metadata to external AI providers.

Install only if you are comfortable sending music filenames, tags, catalog summaries, and playlist prompts to Anthropic or MiniMax. Keep it bound to localhost or a trusted network, add authentication or firewall protection before remote use, protect .env and API keys, and review start.sh because it may kill another process using the same port.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The module presents itself as a local music library/player, but it transmits user prompts and catalog-derived metadata to third-party AI services for interpretation and curation. This mismatch can cause unanticipated data disclosure, especially because catalog vocabulary may reveal private listening habits, languages, regions, or collection contents.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The module presents itself as a local music library/player, but it transmits user prompts and catalog-derived metadata to third-party AI services for interpretation and curation. This mismatch can cause unanticipated data disclosure, especially because catalog vocabulary may reveal private listening habits, languages, regions, or collection contents.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly sends song metadata and user prompts to third-party LLM providers during indexing and playlist generation, but the description does not clearly warn users about that data flow. This creates a real privacy risk because library contents, filenames/tags, and listening-intent prompts may reveal sensitive personal information and users are not given informed consent before setup.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages setting MUSIC_SERVER_URL to a LAN or Tailscale-reachable address so links work on other devices, but does not clearly warn that doing so may expose the service and its library/playlist endpoints to other reachable users. Because the API includes search, stats, playlist generation, and saved playlist access, broader network exposure can leak library contents and increase attack surface.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends user-provided prompts plus catalog vocabulary to external LLM providers without any user-facing notice or consent gate at the call sites. In a music-library context, that can expose sensitive personal preference data and private collection metadata to third parties unexpectedly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The prompt construction includes relative file paths and embedded metadata tags, which are then sent to third-party LLM providers. Those values can contain personal information, library structure, filenames, artist/title notes, or other sensitive metadata, and the code provides no explicit consent gate, redaction, or privacy warning before exfiltrating them.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script unconditionally runs `fuser -k` against the configured port, which will terminate any process listening on that port, not necessarily a prior instance of this service. In a shared environment or on a host running multiple services, this can cause unintended denial of service or kill unrelated applications without confirmation or ownership checks.

Credential Access

High

• Category: Privilege Escalation

Content

if [ -f .env ]; then
    set -a; source .env; set +a
else
    echo "Warning: .env not found. Using defaults or existing environment."
fi

# Use venv if present

• Confidence: 97% confidence
• Finding: `source .env` executes the contents of `.env` as shell code, not just as passive configuration. If an attacker can modify that file or influence its contents, they can achieve arbitrary command execution when the script starts, and any secrets in the environment are then exposed to the launched process and potentially inherited by child processes.

Static analysis

No suspicious patterns detected.