sonoscli

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 10:43 PM UTC
• Version: 1.0.0

Overview

This skill coherently installs and uses a Sonos command-line tool to control local Sonos speakers, with a supply-chain caution because it installs the Go module using a mutable latest version.

Install this only if you are comfortable trusting the upstream sonoscli Go module and allowing the resulting binary local-network access to your Sonos devices. For tighter control, prefer a pinned reviewed version and provide Spotify credentials only when using Spotify search.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned External Go Dependency Uses a Mutable Latest Version

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-16
Vulnerability Type: Supply-chain risk caused by an unpinned executable dependency
Risk Level: Medium

Vulnerable Code:

json

"install":
  [
    {
      "id": "go",
      "kind": "go",
      "module": "github.com/steipete/sonoscli/cmd/sonos@latest",
      "bins": ["sonos"],
      "label": "Install sonoscli (go)",
    },
  ],

Technical Analysis

The installation configuration retrieves github.com/steipete/sonoscli/cmd/sonos@latest. The latest selector is mutable and does not identify a specific reviewed release or commit. Consequently, the source code installed in the future may differ from the code that existed when this Skill was audited.

This creates a dependency supply-chain exposure. If the upstream repository, maintainer account, release process, or one of the resolved dependencies is compromised, a malicious version may be selected by subsequent installations. Although retrieving and compiling ordinary Go source does not inherently execute that application during compilation, the resulting unreviewed sonos executable will run when the Skill invokes it.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the relevant release workflow.
2. The attacker publishes or causes resolution to a malicious version of the sonos command.
3. A user installs the Skill after the malicious version becomes the version selected by @latest.
4. The installation process retrieves and builds the attacker-controlled source instead of a previously reviewed version.
5. The Skill or user subsequently invokes the installed sonos executable.
6. The malicious executable performs actions with the permissions and environmental access of the invoking process.

Impact Assessment

Successful exploitation would provide code execution under the account running the installed sonos binary. Th ...[truncated 556 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a specific, reviewed semantic version, for example:

   json

   "module": "github.com/steipete/sonoscli/cmd/sonos@vX.Y.Z"
   

2. For stronger immutability, pin the dependency to a reviewed commit where supported by the installation framework.
3. Record and verify expected source, module, or artifact checksums before installation.
4. Prefer signed releases and verify available provenance or build attestations.
5. Review the pinned release and its transitive Go dependencies before updating it.
6. Perform dependency updates through a controlled process that includes source review, security scanning, and functional testing.
7. Run the CLI with least privilege and limit filesystem, credential, environment-variable, and local-network access to what Sonos control strictly requires.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep