Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a setlist.fm lookup helper, but it incorrectly presents itself as read-only while documenting attendance actions that change a user account without confirmation.
Review this before installing if you use setlist.fm with an account API key. The lookup tools appear coherent, but the attendance tools can modify your account state and the documentation says they skip confirmation; use only if you are comfortable with that behavior or can disable/gate those tools.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
Add to .mcp.json in your project or ~/.claude/mcp.json:
{
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# setlist-mcp
MCP server for setlist.fm — search concert setlists, artists, venues, and tours via natural language. Read-only (setlist.fm has no write API).
- **npm:** [npmjs.com/package/setlist-mcp](https://www.npmjs.com/package/setlist-mcp)
- **Source:** [github.com/chrischall/setlist-mcp](https://github.com/chrischall/setlist-mcp)
The documentation explicitly markets the skill as read-only, but later exposes setlist_mark_attended and setlist_unmark_attended, which can change a user's setlist.fm account state. This mismatch can cause users or higher-level agents to invoke the skill under false assumptions, leading to unintended account modifications.
The file contains contradictory guidance: it says the service is read-only because setlist.fm has no write API, yet later documents write operations affecting the user's account. Contradictory security-relevant documentation increases the chance that callers, orchestration layers, or users misclassify the skill's risk and permit unsafe actions without proper safeguards.
The attendance tools are documented as writes that 'neither asks for a confirmation step,' which removes a key safety control for account-affecting actions. In an agent setting, that creates a direct path from ambiguous natural-language requests to unintended state changes on a third-party account.
No suspicious patterns detected.