Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent Spotify Ads reporting helper, but it under-discloses sensitive token handling and includes a state-changing report job despite calling the CLI read-only.
Review this skill before installing. Use it only with a least-privilege Spotify Ads token, avoid pasting token values into chat, prefer a controlled or pinned installation of the CLI, and require explicit confirmation before creating CSV report jobs or downloading generated report files.
If the CLI is not installed, install it:
```bash
npm install -g spotify-ads-cli
text
### Technical Analysis
The Skill directs users to install `spotify-ads-cli` globally from the npm registry without pinning an exact reviewed version, verifying package integrity, or validating publisher provenance. Consequently, the package content resolved when the instruction is followed may differ from the version that existed when the Skill was audited.
npm packages may execute lifecycle scripts during installation. If the package, one of its transitive dependencies, its maintainer account, or the registry resolution process is compromised, attacker-controlled code could execute with the privileges of the user running npm. The global `-g` installation unnecessarily broadens the package's system footprint compared with a project-local, version-locked installation.
The separate references to `SPOTIFY_ADS_ACCESS_TOKEN` and `~/.config/spotify-ads-cli/credentials.json` are appropriate for authenticated Spotify Ads API access and do not independently constitute a vulnerability. However, a compromised CLI installed through this unsafe dependency instruction could access those credentials when subsequently invoked.
### Attack Path
1. An attacker compromises the npm package publisher, a transitive dependency, or another part of the package distribution chain.
2. The attacker publishes a malicious version under the package name resolved by `npm install -g spotify-ads-cli`.
3. A user follows the Skill's installation instructions after the malicious release becomes current.
4. npm downloads the unpinned release and may execute attacker-controlled lifecycle scripts during installation.
5. Alternatively, malicious CLI code executes when the Skill later invok
...[truncated 1088 chars]
Remediation
View remediation
Remediation Suggestions
Pin spotify-ads-cli to an exact version that has been reviewed, rather than installing the mutable latest release:
bash
Prefer a project-local installation with a committed lockfile over npm install -g; invoke it through a controlled package script or a version-pinned executable path.
Record and verify the expected package publisher, repository, release provenance, and integrity metadata before installation.
Use npm ci with a committed lockfile in controlled environments so dependency resolution is reproducible.
Where compatible with the package, disable lifecycle scripts during installation:
bash
npm ci --ignore-scripts
If lifecycle scripts are required, review them and their transitive dependencies before enabling them.
Run the CLI as an unprivileged user and grant the Spotify token only the minimum API scopes required.
Keep the credentials file restricted to its owner, such as mode 0600, and avoid exposing the token to unrelated processes.
Document a trusted installation source and a tested version-upgrade review process.
The skill prominently directs use of an OAuth access token but does not constrain how the agent should handle that secret. Without guardrails, an agent may request, echo, or pass the token insecurely, exposing high-value API credentials.
Content
Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
## Authentication
The CLI requires a Spotify **OAuth access token** from a Spotify Developer App with Ads API access. Credentials are resolved in this order:
1. `--credentials <path>` flag (per-command)
2. Environment variable: `SPOTIFY_ADS_ACCESS_TOKEN`
Credential Access
High
Category
Privilege Escalation
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
1. `--credentials <path>` flag (per-command)
2. Environment variable: `SPOTIFY_ADS_ACCESS_TOKEN`
3. Auto-detected file: `~/.config/spotify-ads-cli/credentials.json`
The credentials file format:
Credential Access
High
Category
Privilege Escalation
Confidence
76% confidence
Finding
The error-handling section's wording around verifying an access token can lead an agent to solicit or inspect secret material during debugging. That creates a realistic path to accidental credential disclosure even if exfiltration is not explicitly requested.
Content
Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.
md
## Error handling
- **Authentication errors** -- ask the user to verify their access token; check that `SPOTIFY_ADS_ACCESS_TOKEN` is set or credentials file exists at `~/.config/spotify-ads-cli/credentials.json`
- **Empty reports** -- check the date range, entity status, and whether the account had active ads in the period
- **HTTP errors** -- the CLI surfaces the API error message; common issues include invalid IDs, expired tokens, or insufficient API access
- **JSON parse errors** -- ensure `--targeting` values are valid JSON strings with proper quoting
Credential Access
High
Category
Privilege Escalation
Confidence
76% confidence
Finding
The error-handling section's wording around verifying an access token can lead an agent to solicit or inspect secret material during debugging. That creates a realistic path to accidental credential disclosure even if exfiltration is not explicitly requested.
Content
Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.
md
## Error handling
- **Authentication errors** -- ask the user to verify their access token; check that `SPOTIFY_ADS_ACCESS_TOKEN` is set or credentials file exists at `~/.config/spotify-ads-cli/credentials.json`
- **Empty reports** -- check the date range, entity status, and whether the account had active ads in the period
- **HTTP errors** -- the CLI surfaces the API error message; common issues include invalid IDs, expired tokens, or insufficient API access
- **JSON parse errors** -- ensure `--targeting` values are valid JSON strings with proper quoting
Session Persistence
Medium
Category
Rogue Agent
Confidence
88% confidence
Finding
The skill encourages creation of async CSV reports and management-oriented operations while presenting the tool as read-only, meaning actions can persist beyond the current session on the remote service. In agent workflows, persistent server-side jobs can have cost, privacy, or audit implications if launched automatically without clear consent.
Content
Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
# Spotify Ads CLI Skill
You have access to `spotify-ads-cli`, a read-only CLI for the Spotify Ads API (v3). Use it to query businesses and ad accounts, pull aggregate and insight reports, create async CSV reports, estimate audience sizes and bid ranges, explore targeting options, manage audiences and assets, and track measurement pixels and datasets.
## Quick start
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding
The skill claims the CLI is read-only, but later documents csv-report as a POST request that creates an async report job. This mismatch can cause an agent or user to authorize and execute state-changing actions under the false assumption that the tool only performs safe reads, weakening trust boundaries and approval logic.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding
The authentication section instructs users to supply an OAuth access token via CLI flag, environment variable, or credentials file but provides no guidance on secure handling, redaction, or least exposure. In an agent setting, this increases the chance that secrets are pasted into chat, embedded in command history, stored in world-readable files, or surfaced in logs.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
90% confidence
Finding
csv-report creates an async report job via POST and instructs polling until completion, which is a persistent remote action rather than a transient read. This matters because generated reports may contain sensitive business data, consume service resources, and leave audit artifacts or downloadable URLs that outlive the session.
Content
Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
