T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:86- Finding
Spotify access token disclosed through standard output
- Content
View full analysis
- Remediation
View remediation
Security audit
Spotify Playlist Builder
Security checks for vulnerabilities and agentic risk
Overview
This Spotify skill is purpose-aligned, but it handles OAuth secrets and account-changing actions in ways users should review before installing.
Review this before installing if you care about Spotify account privacy. It can store reusable Spotify credentials locally, read listening history/profile data, and modify playlists. Prefer a version that uses safer secret storage or PKCE, avoids printing tokens, removes unused scopes, and asks for confirmation before playlist changes.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:151- Finding
OAuth secrets and authorization codes accepted through command-line arguments
- Content
View full analysis
--client-secret ``` ```bash python3 scripts/auth.py --client-id --client-secret --code-url "" ``` ### Technical Analysis Command-line arguments are not a suitable transport for confidential values. Depending on the operating system and execution environment, arguments may be visible through process inspection, shell history, Agent tool-call records, command auditing, or orchestration logs. The callback URL contains a short-lived OAuth authorization code, while `--client-secret` contains a long-lived application credential. The simultaneous exposure of both values increases the risk that another party can attempt an unauthorized token exchange before the code expires. Exposure of the client secret also remains significant after the authorization code becomes invalid. ### Attack Path 1. A user follows the documented setup command and supplies the client secret as an argument. 2. If manual authorization is needed, the user also supplies the complete callback URL containing the authorization code. 3. The command is retained in shell history, Agent traces, audit log ...[truncated 935 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/auth.py:95- Finding
Spotify OAuth flow does not validate a state parameter
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Note
- Location
scripts/auth.py:24- Finding
Unused Spotify saved-library permission violates least privilege
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill description frames this as a simple Spotify utility, but the content also instructs OAuth credential collection, token refresh, and local persistence of sensitive tokens at a fixed filesystem path. That mismatch is dangerous because users and orchestrators may authorize the skill for harmless music tasks without realizing it will collect and store credentials and access personal account data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python parser = argparse.ArgumentParser(description="Spotify OAuth") parser.add_argument("--client-id", help="Spotify Client ID") parser.add_argument("--client-secret", help="Spotify Client Secret") parser.add_argument("--refresh", action="store_true", help="Refresh access token") parser.add_argument("--code", help="Authorization code (extracted from URL)") parser.add_argument("--code-url", help="Full callback URL (code extracted automatically)") args = parser.parse_args()
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill accesses and refreshes Spotify access tokens from persistent local storage, which is sensitive credential material. While expected for OAuth-based API access, this becomes dangerous if token storage is weakly protected or if the agent can invoke account actions without clear user awareness, potentially enabling unauthorized access to profile and playlist operations.
- Content
python def refresh_and_retry(): """Refresh token and return new access token.""" try: subprocess.run( [sys.executable, os.path.join(SKILL_DIR, "auth.py"), "--refresh"],
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises shell, network, and file-write capable behavior but does not declare any tool scope or permission boundaries. In practice, this means an agent could invoke credential-handling scripts, write token material to disk, and make outbound API calls without explicit guardrails, increasing the chance of overbroad execution and abuse.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill is designed to create persistent effects across sessions by storing tokens and modifying user playlists, which introduces session-persistence and account-state risks. If invoked unexpectedly or by a compromised agent flow, actions can outlast the current interaction and continue to affect the user's account and locally stored auth state.
- Content
md --- name: spotify-playlist description: Build and manage Spotify playlists from natural language requests. Search tracks/artists/albums, create playlists, manage tracks, view listening history. Use when the user asks to create a playlist, find music, check what they've been listening to, or any Spotify-related request. Examples - "make me a playlist for a rainy Sunday", "what have I been listening to lately", "find songs like Bonobo". --- # Spotify Playlist Builder
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger language is broad enough to activate on nearly any Spotify-related request, not just narrow playlist-building tasks. Overbroad invocation increases the chance the skill runs in contexts where users did not intend account access, history inspection, or state-changing actions like playlist creation and track management.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill encourages use of top-tracks and recently-played data for personalization without clearly warning that it will access personal listening-history information. This creates a privacy risk because users may ask for a playlist and unintentionally expose behavioral data they did not expect the skill to inspect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script persists access tokens, refresh tokens, client ID, and client secret in a local JSON file under the user's home directory. Even with mode 0600, storing long-lived credentials on disk increases the blast radius of local compromise, accidental backup exposure, or misuse by other tools that can read the workspace, and the skill only needs Spotify access rather than permanent credential retention.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def exchange_code(code, client_id, client_secret): auth_header = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode() resp = requests.post("https://accounts.spotify.com/api/token", data={ "grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def exchange_code(code, client_id, client_secret): auth_header = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode() resp = requests.post("https://accounts.spotify.com/api/token", data={ "grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI,
Tainted flow: 'auth_header' from requests.post (line 75, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python def exchange_code(code, client_id, client_secret): auth_header = base64.b64encode(f"{client_id}:{client_secret}".encode()).decode() resp = requests.post("https://accounts.spotify.com/api/token", data={ "grant_type": "authorization_code", "code": code, "redirect_uri": REDIRECT_URI,
Tainted flow: 'tokens' from requests.post (line 60, network input) → requests.post (network output)
Medium
- Category
- Data Flow
- Confidence
- 65% confidence
- Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
- Content
python auth_header = base64.b64encode( f"{tokens['client_id']}:{tokens['client_secret']}".encode() ).decode() resp = requests.post("https://accounts.spotify.com/api/token", data={ "grant_type": "refresh_token", "refresh_token": tokens["refresh_token"], }, headers={"Authorization": f"Basic {auth_header}"})
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python TOKEN_PATH = os.path.expanduser("~/.openclaw/workspace/config/.spotify-tokens.json") SKILL_DIR = os.path.dirname(os.path.abspath(__file__)) API_BASE = "https://api.spotify.com/v1" def get_token():
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script silently reads persisted OAuth tokens from disk and automatically refreshes them via auth.py, which enables account access without any runtime disclosure or consent checkpoint. In an agent-integrated environment, this can make credential use opaque to the user and facilitate broader-than-expected account actions if the skill is triggered indirectly.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def refresh_and_retry(): """Refresh token and return new access token.""" try: subprocess.run( [sys.executable, os.path.join(SKILL_DIR, "auth.py"), "--refresh"], capture_output=True, check=True )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The api helper sends authenticated requests to Spotify and may retrieve listening history, profile, and playlist data tied to a user account, but the script provides no explicit privacy notice or minimization boundary. In a skill context, hidden transmission of account-linked data to external services can surprise users and increase privacy exposure if commands are invoked automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The add and remove commands make irreversible or user-visible playlist changes immediately, with no confirmation, dry-run mode, or guardrails. In an agent setting, misinterpretation of natural-language requests or prompt-injection elsewhere could cause unintended modification or deletion of playlist contents.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill exposes a me command that returns profile fields including email, country, and product, even though the stated purpose is playlist building and music discovery. This expands access to account-linked personal data beyond what is necessary, increasing privacy risk if the agent invokes the command unnecessarily or surfaces the data to other components.
- Content
Static analysis
No suspicious patterns detected.