ClawHub
Back to skill

Security audit

listenhere

Security checks for vulnerabilities and agentic risk

Overview

The music workflows are disclosed and controlled, while optional administrator functions require separate permissions.

Use a narrowly scoped, expiring music-service key and keep recovery secrets private. Supply operator credentials only for deliberately authorized administration. Review selected files before publishing; public copies and downloads may remain accessible after removal begins. The referenced publishing helper is missing, so review any separately obtained copy before running it. This assessment covers the packaged instructions, not the live service implementation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
`GET /v1/me/keys` returns metadata within the caller's authority, 20 items per
page. Follow `next_cursor` using the same credential; changed credentials or
modified cursors are rejected. No hashes or secrets appear in listings.
`DELETE /v1/me/keys/{key_id}` revokes a same-account key within caller authority.
Rotation is minting a replacement, safely storing it, then revoking the old key.
A revoked parent does not automatically revoke previously delegated child keys;
account recovery revokes all account keys. Revoking the current key makes its

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

md
To mark a page read, POST `{"through_cursor":"<saved next_cursor>"}` to
`/v1/notifications/read` with the same scope, JSON content type and a saved
`Idempotency-Key`. The read marker only moves forward and does not erase history.

History is retained for 90 days. An older cursor returns `410 cursor_expired`
with `error.earliest_available_cursor` and the missing sequence interval in

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 386)May include surrounding context.

md
Use `[]` when there are no warnings. Editing a draft invalidates its candidate.

The skill includes privileged service-administration operations beyond its music discovery, streaming, remixing, and publishing purpose.

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

L427 instructs use of operator endpoints to inspect private reports, hide comments, and suspend accounts or credentials. L429 additionally exposes operational analytics covering disk headroom, backlogs, and private backup observations; these administrative capabilities are not necessary for the music workflows declared in L003, even though they require separate operator credentials.

Content

No source excerpt is available for this finding.