Security audit

Airfoil

Security checks for vulnerabilities and agentic risk

Overview

This Airfoil audio-control skill is coherent, but its bundled script handles speaker names unsafely enough that a crafted name could run local commands.

Review this skill before installing. It appears intended for local Airfoil speaker control and does not show hidden persistence or data exfiltration, but the bundled script should be fixed to pass speaker names and volume values as AppleScript arguments and validate volume ranges before use. Avoid using it with untrusted speaker names or agent-generated arguments until that is corrected.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: airfoil.sh:23
Finding: AppleScript Injection Through Unescaped Speaker Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: airfoil.sh:38
Finding: Missing Numeric and Range Validation for Volume Input
Content: View full analysis
<0-100>" >&2 exit 1 fi # Convert 0-100 to 0.0-1.0 for Airfoil's internal scale VOL=$(echo "scale=2; $VALUE / 100" | bc) osascript -e "tell application \"Airfoil\" to set (volume of (first speaker whose name is \"$SPEAKER\")) to $VOL" echo "Volume $SPEAKER: $VALUE%" ;; ``` ### Technical Analysis The documented volume range is 0 through 100, but the implementation only checks whether a value was supplied. It does not verify that the input is an integer or that it falls within the permitted range. The unvalidated value is inserted into a `bc` expression. Malformed input can cause calculation errors, and negative or excessive numeric values can produce values outside Airfoil's expected 0.0–1.0 scale. The result is then inserted into AppleScript source. Because the script enables `set -e`, a failed `bc` operation or subsequent AppleScript error can terminate the command unexpectedly. The lack of validation also creates inconsistent behavior between the documented interface and the actual implementation. ### Attack Path 1. A user, attacker, or calling agent invokes `airfoil.sh volume` with a malformed, negative, or greater-than-100 value. 2. The script accepts the value because it checks only for an empty argument. 3. The value is processed by `bc`, potentially producing an error or an out-of-range result. 4. The result is passed to Airfoil through `osascript`. 5. The operation may terminate unexpectedly or attempt an unintended volume setting. ### Impact Assessment The primary impact is limited to application behavior and availability: - Unexpected termination of the requested operation. - Out-of-range or unintended speaker volume changes if accepte ...[truncated 239 chars]
Remediation: View remediation
100 )); then echo "Error: volume must be an integer from 0 to 100" >&2 exit 1 fi ``` Avoid constructing arithmetic language source from untrusted input. After strict integer validation, Bash arithmetic can perform the conversion, or the validated value can be passed as an AppleScript positional argument and divided inside a static script. Recommended hardening steps: 1. Require an integer matching `^[0-9]+$`. 2. Enforce the inclusive range `0–100`. 3. Pass the validated value to AppleScript through `argv`. 4. Check calculation and `osascript` failures explicitly. 5. Print a success message only after Airfoil confirms that the setting was applied. 6. Add tests for empty, nonnumeric, negative, decimal, and greater-than-100 inputs. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description presents speaker control as convenient automation but does not warn users that commands can immediately reroute audio, disconnect active speakers, or alter volume on shared devices. Without an upfront warning, users may invoke the skill in inappropriate contexts and unexpectedly disrupt meetings, media playback, or other shared listening environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation examples use broad natural-language phrases like 'Turn the music down' and 'Which speakers are on?' that can plausibly occur in ordinary conversation and be mapped to immediate device-control actions. In a voice- or chat-driven agent context, this increases the risk of accidental activation that changes audio routing or volume without explicit user confirmation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.