setlist-fpx

• Outcome: Review
• Latest audit: Oct 16, 2026 · 10:29 AM UTC
• Version: 1.1.9

Overview

The skill is mostly transparent about using setlist.fm, but it asks users to extract and replay browser session cookies to perform account actions, which deserves careful review.

Install only if you are comfortable granting a local tool and browser extension access to your setlist.fm login cookies. Treat the captured COOKIE value like a password, avoid sharing logs or screenshots that include it, and remove/unpair the bridge profile when you are done if you do not want continued access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (20)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The skill performs an authenticated state-changing request using a raw captured session cookie, replaying browser AJAX calls against the website. This is dangerous because anyone running the workflow with a stolen, over-broad, or wrong-session cookie can unintentionally or unauthorizedly modify account state, and the request target is derived from page-parsed HTML rather than a fixed API contract.

Content

Scanner excerpt · references/attendance-write.md (reported line 108)May include surrounding context.

md

AJAX_PATH=$(echo "$FULL_AJAX_URL" | sed -E 's#https?://[^/]+##')
BASE_URL_HEADER=$(echo "$PATH_ONLY" | sed -E 's#^/##')   # Wicket-Ajax-BaseURL wants no leading slash

curl -s "https://www.setlist.fm$AJAX_PATH" \
  -H "Cookie: $COOKIE" -H "User-Agent: $UA" \
  -H 'Wicket-Ajax: true' \
  -H "Wicket-Ajax-BaseURL: $BASE_URL_HEADER" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to extract and reuse authenticated session cookies, including an HttpOnly session token, outside the browser and replay them with curl. This bypasses normal browser confinement for login state and creates a reusable bearer credential that could be exposed via shell history, environment leakage, logs, screenshots, or process inspection, enabling account actions as the user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/attendance-write.md (reported line 19)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 3)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 15)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 25)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 32)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 50)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 65)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 76)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 87)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 97)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 104)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 116)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 127)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 134)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 147)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 154)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/rest-api.md (reported line 162)May include surrounding context.

md

# setlist.fm REST API — read endpoints for curl

Base URL: `https://api.setlist.fm/rest` · every call: `-H "x-api-key: $SETLIST_API_KEY" -H 'Accept: application/json'`.
Optional: `-H "Accept-Language: en"` (one of `en es fr de pt tr it pl`) to localize city/country names.

All 15 read endpoints below are exactly what `setlist-mcp`'s tools call — same paths, same params.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:37