Internet Radio Music Db

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:56 AM UTC
• Version: 2.6.3

Overview

This skill appears purpose-aligned for managing internet radio streams, but it can make recurring network requests to arbitrary stream URLs and automatically delete saved entries without confirmation.

Install only if you are comfortable with this skill making outbound requests to many radio-stream URLs and modifying its local database. Avoid scheduling the cron tasks on sensitive networks unless URL validation or network egress controls are added, and keep backups of state.json because availability checks can permanently remove entries after repeated failures.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_stream.py:101

Finding

Unvalidated Stream URLs Enable Blind Server-Side Request Forgery

Content

View full analysis

= 4: cmd_add(args[1], args[2], args[3], args[4] if len(args) > 4 else "unknown") ``` The availability checker subsequently submits every persisted stream URL for parallel processing: ```python future_to_idx = { executor.submit( check_stream_adaptive, s["url"], s.get("bitrate") ): i for i, s in check_map.items() } ``` The shared checker performs the resulting request without destination validation: ```python try: req = urllib.request.Request(url, headers=headers) with urllib.request.urlopen(req, timeout=timeout) as resp: while True: ``` ### Technical Analysis There is no allowlist or validation between URL ingestion and the network request. A URL stored through `cli.py add`, inserted into `state.json`, or obtained from externally controlled station-directory content can therefore target: - Loopback addresses such as ...[truncated 2840 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description emphasizes an internet-radio.com stream database with automatic collection/population and availability checking based on bitrate-aware thresholds. The provided code only implements a simple command-line interface over a local JSON file (state.json), supporting list/add/remove/export operations. While this is loosely related to managing a stream database, it omits the central advertised behaviors: harvesting ~150+ streams from the referenced site, checking availability, and applying adaptive bitrate/speed logic. There are no suspicious undeclared external accesses or unrelated harmful behaviors, but the implemented functionality is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documentation describes capabilities that read and write local state and make external network requests, but it does not declare any explicit tool scope or permissions boundary. That creates a transparency and governance gap: users and platforms cannot easily constrain or review what the skill is allowed to do before installation or execution.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

The skill documents autonomous deletion of stream records after repeated failed checks, which is a form of unsupervised state-changing decision making. If checks are inaccurate, manipulated by remote endpoints, or affected by transient network issues, legitimate entries can be removed automatically, causing data loss and making the database state dependent on unreliable external conditions.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- Parallel check of all streams (120 workers)
- Uses the same adaptive threshold (shared `check_stream.py` module)
- Streams with `failed_checks >= 3` are automatically removed
- Extra fields stored: `check_speed_bps`, `check_threshold_kbs`, `check_bytes_received`

### Stream record format

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The changelog states 'Full English translation of all scripts and documentation,' which signals a fixed language choice rather than offering a locale or language option. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code infers a station language from keywords and falls back to returning "en" when no match is found. This imposes a locale classification without user opt-in or explicit justification, which can mislabel content and conflicts with the policy against forcing a language/locale choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script permanently deletes stream entries from the persistent state after three failed checks without any explicit user confirmation, backup, or quarantine step. Because availability checks depend on external network conditions and remote endpoints, transient outages, rate limiting, or local connectivity issues can cause false negatives that lead to unintended data loss.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/check_stream.py (reported line 68)May include surrounding context.

python

return int(threshold_kbs * 1024 * TEST_DURATION * 0.5)


def check_stream(url, bitrate_kbps=None, test_duration=None, timeout=None):
    """Check if a stream is available and meets its bitrate-based speed threshold.

    Args:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This manifest-style data labels stations with non-English names and likely non-English content under a fixed language field, which can force an English locale classification without user choice. That conflicts with the policy against imposing a language/locale constraint unless it is optional or clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill describes automated scraping/checking of external radio endpoints and persistent writes to state.json, but it does not clearly warn users that running it will generate outbound requests and alter local stored data. This weakens informed consent and can cause unexpected network activity or persistent state changes in environments where such actions should be explicitly approved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function performs an outbound HTTP request to the provided stream URL, which transmits network metadata such as the request headers and the caller's IP address. While the module docstrings describe functionality, there is no confirmation prompt, warning, or user-facing disclosure in the code around this externally observable operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The station name explicitly identifies a French context, and the language field is set to fr here while many other entries appear normalized to en regardless of station identity. This inconsistency suggests locale policy is being handled by hard-coded metadata rather than user choice or clearly documented regional scoping.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: state.json:2033