ClawHub
Back to skill

Security audit

iFLYTEK Song Recognition

Security checks for vulnerabilities and agentic risk

Overview

The skill broadly performs song recognition, but it can upload any readable file path to an external iFlytek API without validating that it is audio or limiting file size.

Review before installing. Use this only with audio files you intentionally want to send to iFlytek, avoid sensitive or private recordings, and do not let untrusted prompts or workflows choose the file path. A safer version should restrict inputs to an approved upload directory, reject symlinks and non-regular files, validate audio type, enforce a maximum size, and clearly disclose the external upload.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/index.py:101
Finding

Unrestricted Local File Read and Upload to External Recognition API

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The documentation overstates or misrepresents behavior by claiming singing recognition and ACRCloud-based technology while the described invocation only accepts an audio file path and the implementation reportedly calls an iFlytek endpoint directly. Security-relevant behavior mismatches are dangerous because reviewers and users may approve or supply data based on false assumptions about what the skill does and which third party receives it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares environment-variable and network-dependent behavior but does not define an explicit tool/permission scope. That weakens sandboxing and reviewability because users and platforms cannot clearly see that the skill will access credentials and make outbound requests to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill handles user audio and API credentials yet does not clearly warn that audio content will be transmitted over the network to a third-party recognition service. This is a privacy and trust issue because users may unknowingly upload sensitive or copyrighted audio, and operators may expose credentials without understanding the external data flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill reads a local audio file, base64-encodes its contents, and sends that data to a third-party cloud endpoint for recognition without any explicit user consent, privacy notice, or data-minimization control at the point of transmission. Audio can contain sensitive personal content, so silently exporting it off-host creates a real privacy and compliance risk even though remote processing is expected for this skill's functionality.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs an outbound HTTP POST to an external API and includes the full audio payload in the request body. In the context of a song-recognition skill this network behavior is functionally necessary, but it is still a genuine data-exfiltration surface because local file contents leave the system and may expose sensitive recordings if users are not adequately informed or if untrusted file paths are supplied.

Content

Scanner excerpt · scripts/index.py (reported line 179)May include surrounding context.

python
signed_url = self.create_signed_url(self.host_url, "POST")

            print("Calling song recognition API...")
            response = requests.post(
                signed_url,
                json=request_body,
                timeout=self.timeout