ClawHub
Back to skill

Security audit

musescore-fpx

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed MuseScore helper that uses a browser bridge to fetch MuseScore pages and parse public score metadata, with some install and temp-file hygiene caveats.

Install only if you are comfortable adding the Transporter extension and globally installing @fetchproxy/cli. Restrict the extension's site access to musescore.com, avoid running the commands with sudo, and prefer private mktemp directories instead of the documented /tmp/search.html and /tmp/score.html examples.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding
Unpinned Global Installation of a Third-Party CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-29 **Vulnerability Type**: Unpinned global dependency installation **Risk Level**: Medium ```sh npm install -g @fetchproxy/cli # provides `fpx` fpx profile add musescore --domain musescore.com fpx pair -p musescore # prints a pair code → approve in Transporter ``` ### Technical Analysis The setup instructions install the latest available version of `@fetchproxy/cli` globally without an exact version, lockfile, integrity hash, or other provenance verification. npm packages may execute lifecycle scripts during installation. A global installation also makes the package available outside this Skill and can increase its impact on the host. The CLI is subsequently trusted to establish persistent pairing with a browser extension and issue requests using browser session context. The supplied project does not include the CLI's source code or dependency tree, so those components could not be audited here. This is a supply-chain exposure rather than evidence that the current package is malicious. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or a transitive dependency. 2. A malicious version is published under the existing package name. 3. A user follows the Skill instructions and runs the unpinned global installation. 4. npm retrieves the compromised release, which may execute malicious lifecycle code during installation. 5. The installed CLI may then execute arbitrary code with the user's privileges or misuse its browser-extension pairing and browser-accessible session context. ### Impact Assessment Successful exploitation could provide code execution with the privileges of the user running npm. Depending on the compromised component's behavior, this could expose user-accessible files, modify global npm-installed tooling, or abuse the browser bridge. The project does not instruct users to run the installation as r ...[truncated 197 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin `@fetchproxy/cli` to an exact, reviewed version rather than installing the latest release. - Document the expected publisher, package registry, version, and package integrity value. - Prefer a project-local dependency governed by a lockfile instead of a global installation. - Where compatible, install with lifecycle scripts disabled and explicitly enable only scripts that have been reviewed. - Verify package provenance or signed release artifacts before installation. - Document the browser extension permissions and restrict its site access to `musescore.com`. - Advise users not to execute npm installation commands with elevated privileges. - Periodically review the pinned CLI and its transitive dependency tree before upgrading. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:41
Finding
Predictable Files in a Shared Temporary Directory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-52 **Vulnerability Type**: Unsafe predictable temporary files **Risk Level**: Low ```sh fpx get 'https://musescore.com/sheetmusic?text=zelda&recording_type=free-download' -p musescore \ > /tmp/search.html ``` ```sh node references/extract-store.js scores < /tmp/search.html | jq '.[] | {id, title, composer_name}' ``` Equivalent predictable-file usage also appears in `references/endpoints.md`, including `/tmp/search.html` at lines 20-23 and `/tmp/score.html` at lines 72-73 and line 94. ### Technical Analysis The examples redirect output into fixed file names under the shared `/tmp` directory. On systems where another local user can create entries in that directory, an attacker may pre-create one of these paths as a symbolic link. Shell output redirection can then follow that link and overwrite another file writable by the victim. Fixed names also cause race conditions between concurrent Skill runs. One process can overwrite the HTML while another process is parsing it, resulting in incorrect, attacker-influenced, or corrupted extraction output. The expected files contain MuseScore HTML rather than credentials, which limits confidentiality impact. The primary risks are local file clobbering, integrity loss, and unreliable parsing. ### Attack Path 1. A local attacker predicts that the victim will use `/tmp/search.html` or `/tmp/score.html`. 2. The attacker creates the expected path as a symbolic link to another file writable by the victim, or continually replaces the temporary content. 3. The victim follows the documented command. 4. Shell redirection follows the symbolic link and overwrites the linked file, or the attacker substitutes content before the extraction step. 5. The victim may suffer file corruption or process attacker-controlled HTML as if it were the MuseScore response. ### Impact Assessment Exploitation is limited to files the invoking user already has permission t ...[truncated 338 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Create a private temporary directory using `mktemp -d`. - Store all intermediate files inside that directory using non-predictable names. - Set a restrictive `umask`, such as `077`, before creating temporary files. - Register a shell trap to remove temporary content on normal exit and interruption. - Avoid reusing temporary paths between concurrent operations. - Prefer direct pipelines when retaining the HTML is unnecessary. - Explicitly warn users not to run the commands as root or with `sudo`. Example hardened pattern: ```sh umask 077 tmpdir="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$tmpdir"' EXIT HUP INT TERM fpx get 'https://musescore.com/sheetmusic?text=zelda&recording_type=free-download' \ -p musescore > "$tmpdir/search.html" node references/extract-store.js scores < "$tmpdir/search.html" | jq '.[] | {id, title, composer_name}' ``` ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.