Trackyard

PassAudited by ClawScan on May 1, 2026.

Overview

Trackyard appears to be a straightforward Trackyard API wrapper for searching and downloading licensed music, with disclosed API-key use and credit-consuming actions.

Install only if you are comfortable providing a Trackyard API key to this skill. Use a revocable key if possible, monitor Trackyard credits and usage, and confirm searches/downloads or custom output paths before the agent runs them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent using this skill with the environment variable can act against the associated Trackyard account for supported operations, including viewing account information and performing credit-consuming searches/downloads.

Why it was flagged

The helper uses the configured Trackyard API key as a bearer credential when calling Trackyard endpoints.

Skill content

-H "Authorization: Bearer $TRACKYARD_API_KEY"

Recommendation

Use a dedicated, revocable Trackyard API key if possible, keep it out of logs, and monitor Trackyard usage and credits.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Agent-initiated searches or downloads can spend Trackyard credits and save downloaded MP3 files into the workspace.

Why it was flagged

The documented normal workflow includes operations that consume account credits.

Skill content

- Search: 1 credit
- Download: 1 credit
- Account info: Free

Recommendation

Set clear limits or require confirmation before credit-consuming searches, downloads, batch workflows, or custom output paths.