aux

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:34 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Spotify integration, but it asks users to run an unpinned npm package that handles Spotify credentials and tokens, so users should review it before installing.

Install only if you trust the `spotify-aux` npm package and publisher. Prefer a pinned, reviewed package version before running login or MCP registration, and understand that the package will receive Spotify app credentials, manage local OAuth tokens, register an MCP server, and may run local helper services for AutoDJ or party hosting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Is Downloaded and Executed with Spotify Credential Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–38
Vulnerability Type: Unpinned npm dependency and runtime package execution
Risk Level: Medium

Vulnerable Code

bash

npm i -g spotify-aux
npx spotify-aux login   # PKCE → ~/.aux-mcp/

bash

openclaw mcp add aux \
  --command npx \
  --arg -y \
  --arg spotify-aux \
  --env SPOTIFY_CLIENT_ID="$SPOTIFY_CLIENT_ID" \
  --env SPOTIFY_CLIENT_SECRET="$SPOTIFY_CLIENT_SECRET"

openclaw mcp doctor aux --probe

bash

npx spotify-aux openclaw
# copies skills/aux-mcp/SKILL.md → ~/.openclaw/skills/aux-mcp/SKILL.md

Technical Analysis

The installation and execution instructions refer to spotify-aux without specifying an exact package version or integrity hash. In particular, registering the MCP server with npx -y spotify-aux permits npm to resolve and execute a package release at runtime without interactive confirmation. Consequently, the effective executable can change after this Skill has been reviewed.

The MCP registration explicitly supplies SPOTIFY_CLIENT_ID and SPOTIFY_CLIENT_SECRET to the package process. The login workflow also creates or accesses authentication data under ~/.aux-mcp/. npm installation scripts and the resulting package execute with the privileges of the current operating-system user. This creates a supply-chain trust boundary that cannot be audited from this repository because the package implementation and a dependency lockfile are not included.

This finding does not establish that the current spotify-aux release is malicious. The vulnerability is the unsafe, mutable dependency execution model and its exposure to sensitive credentials.

Attack Path

1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or another part of the package publishing pipeline.
2. The attacker publishes a malicious release under the expected spotify-aux package ...[truncated 1663 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin spotify-aux to a reviewed, exact version in every command, including installation and MCP registration. Do not use version ranges or implicit latest-version resolution.
2. Replace runtime npx -y downloads with execution from a previously verified local installation. Avoid automatically accepting package installation prompts.
3. Maintain a lockfile and verify package integrity using npm integrity metadata or cryptographic hashes from a trusted release process.
4. Audit the selected package release, its lifecycle scripts, and its complete transitive dependency tree before deployment.
5. Prefer a trusted immutable artifact or a source-controlled build tied to a specific commit and reproducible release.
6. Run the MCP server under a dedicated, least-privileged operating-system account or sandbox with restricted filesystem and network access.
7. Expose only credentials required for the requested operation. Avoid passing a client secret when a PKCE-only flow is sufficient.
8. Store OAuth tokens with restrictive filesystem permissions and prevent the package from accessing unrelated user files.
9. Add package provenance or signature verification to detect unauthorized releases.
10. Rotate Spotify client credentials and revoke OAuth tokens immediately if an untrusted package version has been executed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs users to execute npx spotify-aux without pinning a specific package version. Because npx resolves the latest published package by default, a compromised upstream package, malicious update, or typosquatted replacement could cause arbitrary code execution on the user's machine during install or runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This invocation again relies on an unpinned npx spotify-aux package. Unpinned remote package execution increases supply-chain risk because users may fetch and run newly published code that has not been reviewed in the context of this skill.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash

npx spotify-aux openclaw
# copies skills/aux-mcp/SKILL.md → ~/.openclaw/skills/aux-mcp/SKILL.md

Redirect URI (exact): http://127.0.0.1:7654/callback

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to use' table includes generic trigger phrases such as 'Keep it going' and broad categories like 'Party / friends queue' without clear exclusion conditions or scope boundaries. In a markdown skill description, these ambiguous triggers can cause unintended invocation because they overlap with everyday speech and the file does not provide negative examples clarifying when the skill should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documented npx spotify-aux autodj helper executes an unpinned npm package. If the package or one of its dependencies is compromised, running this command could execute attacker-controlled code with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The npx spotify-aux party-host example has the same unpinned execution problem. Since this mode appears to expose a local relay service, combining remote package execution with a network-facing helper can increase the blast radius if a malicious package version is fetched.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The login instruction npx spotify-aux login is unpinned and particularly sensitive because it handles OAuth login and local token material under ~/.aux-mcp/. A malicious package update at this step could steal credentials or tokens while appearing to perform normal authentication.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.