ClawHub
Back to skill

Security audit

Internet Radio Music Player

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed internet radio controller that reads a radio database, controls Foobar2000, and saves playback history; the notable risks are expected for that purpose.

Install this only if you want OpenClaw to control Foobar2000 for internet radio. Be aware it will contact stream URLs, stop existing Foobar2000 playback when switching or stopping, and keep a local playback history. Review the separate Internet Radio Music DB and optional web UI plugin independently before installing them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
time.sleep(2)
    subprocess.Popen([FOOBAR, "/stop"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    time.sleep(1)
    subprocess.Popen([FOOBAR, "/play", url], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)


def stop_foobar():
Confidence
88% confidence
Finding
This subprocess call passes a user-influenced URL directly to an external player process. While it does not use a shell, it can still cause the application to open arbitrary local or remote resources, enabling SSRF-like network access, unexpected protocol handling, or abuse of the media player's parser if a crafted URL or playlist is supplied.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The documented triggers include generic conversational words like "Next," "Stop," and "Back" without requiring a skill-specific prefix or media context. In a voice or chat-driven agent, these broad phrases can be invoked unintentionally during unrelated interactions, causing unintended playback control actions and increasing the risk of command hijacking or cross-skill interference.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger "Play music" is extremely broad and overlaps with common natural-language requests that may be intended for other skills, apps, or system assistants. This can cause accidental invocation, misrouting of user intent, and untrusted stream playback from this skill when the user did not explicitly choose it.

Static analysis

No suspicious patterns detected.