ClawHub
Back to skill

Security audit

Spotify History

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it grants and stores Spotify account access more broadly than its music-history purpose requires.

Review before installing. Use it only on a trusted machine, grant the minimum Spotify scopes needed, avoid the raw `json` endpoint unless you understand what it can read, and treat the stored token as sensitive account access.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/spotify-auth.py:24
Finding

OAuth Authorization Flow Does Not Validate the State Parameter

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Note
Location
scripts/spotify-auth.py:15
Finding

OAuth Scopes Exceed the Skill's Implemented Functional Requirements

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (19)

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/spotify-api.py (reported line 45)May include surrounding context.

python
}
    )
    
    with urllib.request.urlopen(req) as resp:
        new_data = json.load(resp)
    
    # Keep refresh token if not returned

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/spotify-api.py (reported line 66)May include surrounding context.

python
}
    )
    
    with urllib.request.urlopen(req) as resp:
        new_data = json.load(resp)
    
    # Keep refresh token if not returned

Tainted flow: 'req' from os.environ.get (line 36, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/spotify-api.py (reported line 76)May include surrounding context.

python
}
    )
    
    with urllib.request.urlopen(req) as resp:
        new_data = json.load(resp)
    
    # Keep refresh token if not returned

Tainted flow: 'req' from os.environ.get (line 68, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/spotify-auth.py (reported line 77)May include surrounding context.

python
}
    )
    
    with urllib.request.urlopen(req) as resp:
        return json.load(resp)

def save_token(token_data):

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose is limited to listening history, top items, and recommendations, but the documented json command allows arbitrary Spotify Web API endpoint access. That broader behavior can expose additional account data or actions beyond user expectations, violating least privilege and making misuse easier.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

  • Token expired and auto-refresh failed
  • Delete token and re-authenticate:
    bash
    rm ~/.config/spotify-clawd/token.json
python3 scripts/spotify-auth.py

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README advertises access to listening history, top artists, and recommendations but does not warn that these are privacy-sensitive data tied to a personal account. Because music history can reveal habits, preferences, routines, or potentially sensitive interests, missing disclosure increases the risk of uninformed consent and inappropriate handling of personal data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation examples are open-ended and encourage the agent to fetch and analyze a user's Spotify data without clear limits on when access should occur. In a skill that processes personal listening history, broad triggers can lead to over-collection or use of sensitive preference data in situations where the user did not clearly consent to that specific access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents capabilities that involve shell execution, file reads/writes, environment access, and network access, but it does not declare any explicit tool scope or permission boundaries. This increases the chance an agent will invoke the skill with broader privileges than users expect, especially because the workflow handles secrets and OAuth tokens.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
### Manual Setup

1. **Create Spotify Developer App**
   - Go to [developer.spotify.com/dashboard](https://developer.spotify.com/dashboard)
   - Click **Create App**
   - Fill in:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

"client_secret": "your_client_secret" } EOF chmod 600 credentials/spotify.json

text

**Option B: Environment variables**

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Option B: Environment variables

bash
# Add to ~/.zshrc or ~/.bashrc
export SPOTIFY_CLIENT_ID="your_client_id"
export SPOTIFY_CLIENT_SECRET="your_client_secret"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Advertising a narrowly focused history/recommendation skill while exposing a raw endpoint interface is a scope discrepancy that can enable access to data not implied by the description. In agent settings, this is dangerous because downstream users may authorize or trust the skill based on a much narrower understanding of its behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script collects the Spotify client secret using a normal read -p, which echoes the secret to the terminal and may expose it to shoulder surfing, screen recording, terminal logging, or shared-session capture. In a setup script specifically handling API credentials, this is a real confidentiality weakness even though it affects developer credentials rather than arbitrary code execution.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 63)May include surrounding context.

sh
}
EOF

chmod 600 "$CREDS_FILE"
echo "✓ Credentials saved to: $CREDS_FILE"
echo

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code makes authenticated HTTP requests to Spotify endpoints that retrieve personal listening data such as recently played tracks, top artists, and top tracks. While the module docstring describes functionality, there is no explicit warning, confirmation, or user-facing disclosure that personal account data will be sent to and fetched from Spotify services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/spotify-api.py (reported line 56)May include surrounding context.

python
return new_data

def api_request(endpoint, token_data, params=None):
    url = f"https://api.spotify.com/v1{endpoint}"
    if params:
        url += "?" + urllib.parse.urlencode(params)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The json command exposes arbitrary Spotify API endpoint access, which exceeds the stated skill scope of listening history, top items, and recommendations. In an agent setting, this broadens the accessible data surface to additional profile, library, device, or account endpoints that the user may not expect this skill to query.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Allowing arbitrary endpoint querying is unjustified for the declared purpose of listening-history analytics and recommendations. This overbroad capability can be abused by downstream prompts or agents to retrieve unrelated user data from Spotify using the same OAuth token, violating least privilege and increasing privacy risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.