ClawHub
Back to skill

Security audit

音乐发现应用

Security checks for vulnerabilities and agentic risk

Overview

This music app does not look malicious, but it deserves review because its setup installs many dependencies from an under-disclosed third-party npm mirror and starts a broadly exposed development backend.

Install only in a disposable or development environment, review the dependency sources, regenerate the npm lockfile from a registry you trust, update vulnerable pinned packages, and change local backend startup to bind to `127.0.0.1` unless you intentionally want LAN access. Treat search terms as shared with the listed third-party music APIs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
frontend/package-lock.json:33
Finding

Third-Party npm Package Mirror Expands the Dependency Supply-Chain Trust Boundary

Content
View full analysis

Vulnerability Details

File Location: frontend/package-lock.json:33-34 and numerous subsequent resolved entries
Vulnerability Type: Third-party dependency source
Risk Level: Medium

Representative code snippet:

json
"node_modules/@alloc/quick-lru": {
  "version": "5.2.0",
  "resolved": "https://registry.npmmirror.com/@alloc/quick-lru/-/quick-lru-5.2.0.tgz",
  "integrity": "sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==",
  "dev": true,
  "license": "MIT"
}

Technical Analysis

The lockfile directs npm to download this and numerous other dependency archives from registry.npmmirror.com rather than the official npm registry. This creates an additional supply-chain trust boundary that is not necessary for the application's declared music-discovery functionality.

SHA-512 integrity values allow npm to detect artifacts that differ from the lockfile's expected content. They substantially mitigate undetected archive replacement but do not eliminate risks associated with trusting an additional registry, including availability, registry governance, artifact provenance, and future lockfile updates generated against that source.

The integrity value is a standard package checksum. It is not sensitive information, does not encode user data, and is not evidence of a covert exfiltration or decode-and-execute mechanism. The static pre-scan warning concerning encoded sensitive output is therefore a false positive.

Attack Path

  1. A user follows the project instructions or executes start.sh.
  2. npm install reads frontend/package-lock.json.
  3. npm retrieves dependency archives from the specified third-party mirror.
  4. If the mirror, its delivery infrastructure, or dependency provenance is compromised—and an accepted artifact or lockfile is introduced—the package is installed locally.
  5. Any dependency lifecycle script permitted by npm could ...[truncated 689 chars]
Remediation
View remediation

Remediation Suggestions

  • Regenerate the lockfile using the official npm registry, https://registry.npmjs.org/.
  • Enforce the approved registry through project and CI configuration.
  • Use npm ci in automated builds so installation strictly follows the reviewed lockfile.
  • Use npm ci --ignore-scripts where dependency lifecycle scripts are not required.
  • Retain integrity hashes and review all lockfile changes.
  • Pin security-sensitive production dependencies and run dependency auditing in CI.
  • Use a controlled internal registry only when it provides documented provenance, access controls, monitoring, and artifact verification.

T09 · Insecure Skill Coding Practices

Note
Location
start.sh:30
Finding

Development Backend Is Exposed on All Network Interfaces with Automatic Reload Enabled

Content
View full analysis

Vulnerability Details

File Location: start.sh:30-31
Vulnerability Type: Excessive network exposure and development configuration
Risk Level: Low

Code snippet:

bash
# 后台启动后端
python -m uvicorn app.main:app --reload --host 0.0.0.0 --port 8000 &
BACKEND_PID=$!

The same unsafe defaults also appear in backend/app/main.py:463-477:

python
if ssl_config["ssl_enabled"] and ssl_context:
    logger.info("启动 HTTPS 服务器")
    uvicorn.run(
        "main:app",
        host="0.0.0.0",
        port=8000,
        ssl=ssl_context,
        reload=True
    )
else:
    logger.info("启动 HTTP 服务器")
    uvicorn.run(
        "main:app",
        host="0.0.0.0",
        port=8000,
        reload=True
    )

Technical Analysis

Binding Uvicorn to 0.0.0.0 makes the backend reachable through every available network interface. Enabling --reload simultaneously runs development-oriented file-watching behavior. These settings exceed the minimum privileges and exposure necessary for the documented local application workflow, which only requires communication between the local frontend and backend.

The API does not implement authentication because it proxies public music services. Rate limiting is present, but it does not restrict which hosts can connect and does not replace network access controls. API documentation may also be reachable through the default FastAPI documentation routes.

Attack Path

  1. A user executes start.sh on a device connected to a shared or untrusted network.
  2. Uvicorn listens on port 8000 across all interfaces.
  3. A remote host that can route to the device discovers or directly accesses port 8000.
  4. The remote host invokes the unauthenticated API and documentation endpoints.
  5. The attacker can repeatedly trigger server-side requests to the configured music services, subject to rate limits.

Impact Assessment

A reachable attacker can i ...[truncated 376 chars]

Remediation
View remediation

Remediation Suggestions

  • Bind local development services to 127.0.0.1 by default:

    bash
    python -m uvicorn app.main:app --host 127.0.0.1 --port 8000

  • Make external binding an explicit, documented opt-in configuration.

  • Disable automatic reload outside a dedicated development profile.

  • Deploy production instances behind a hardened reverse proxy with TLS, firewall rules, request-size limits, timeouts, and rate limiting.

  • Disable or restrict FastAPI documentation routes in production when they are not needed.

  • If remote API access is required, add appropriate authentication or gateway controls rather than relying only on CORS.

  • Run the service as a dedicated unprivileged account with minimal filesystem and network permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (62)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

整体上，代码的大部分核心功能与声明基本一致：确实是音乐发现相关后端，且实现了音乐搜索、歌词、网络电台、演唱会信息，并集成多个外部音乐 API。未发现明显恶意、越权或与音乐无关的能力。不过仍存在描述与行为的不完全一致：代码额外实现了艺术家详情查询接口，而描述未明确列出该能力；此外，代码包含 HTTPS/SSL 配置、CORS 和速率限制等服务端能力，虽然属于支撑实现，但其中 SSL 配置意味着比单纯“音乐发现应用”描述更具体的部署/网络行为。最重要的是，描述强调“无需任何认证”，而代码只能证明调用的这些外部 API 中至少 Bandsintown 使用了 app_id 参数，虽不一定是严格认证，但并非完全无标识访问。综合来看，这是轻度但真实的描述—行为不完全匹配，应判定为 mismatch。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about end-user music discovery functionality, but the supplied code chunk is purely backend transport security infrastructure. It does not implement music search, lyrics, radio, concert info, or music API integration. While SSL support could be a legitimate supporting detail in a larger app, this chunk’s actual purpose is materially different from the declared purpose and represents undeclared security/configuration capabilities unrelated to the stated feature set.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents a music discovery application with several user-facing media features and external API integration. However, the supplied code chunk only configures CSS processing tools (Tailwind CSS and Autoprefixer) for the frontend build. This is a supporting styling/build detail and does not substantiate the declared primary purpose. Because the actual code shown is unrelated to the claimed feature set and implements none of the described capabilities, this chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fastapi==0.104.1 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High
Category
Supply Chain
Confidence
92% confidence
Finding

Pinning FastAPI to 0.104.1 is a real supply-chain risk because the version is flagged with a published advisory (CVE-2024-24762). In a public-facing music discovery app built on FastAPI, framework-layer parsing or request-handling flaws can expose the service to denial of service or other request-driven attacks, increasing the practical risk.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-multipart==0.0.6 — 16 advisory(ies): CVE-2024-24762 (python-multipart vulnerable to Content-Type Header ReDoS); CVE-2024-53981 (Denial of service (DoS) via deformation `multipart/form-data` boundary); CVE-2026-53539 (python-multipart: Quadratic-time querystring parsing with semicolon separators c) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

python-multipart 0.0.6 is a true vulnerability because it has multiple advisories, including multipart parsing denial-of-service issues such as ReDoS and malformed boundary handling. Since this backend includes FastAPI and python-multipart, any file upload or form-data endpoint could let remote attackers consume CPU or crash request processing with crafted requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.5 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High
Category
Supply Chain
Confidence
92% confidence
Finding

brace-expansion 5.0.5 has multiple denial-of-service issues involving pathological brace patterns that can trigger excessive CPU or memory consumption. Here it is transitively included in dev tooling, so it is unlikely to be remotely exploitable in production, but it can still disrupt CI, local builds, or any workflow that accepts attacker-controlled glob-like input.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.16.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

axios 1.16.0 is a runtime dependency and the advisories include denial-of-service, prototype-pollution-related behavior, and proxy-bypass classes of issues. Because this music app integrates multiple external free music APIs without authentication, HTTP client behavior is security-relevant and these flaws can materially affect server-side requests, request routing, or application availability.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.14 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)

High
Category
Supply Chain
Confidence
93% confidence
Finding

brace-expansion 1.1.14 has known resource-exhaustion vulnerabilities that can cause CPU or memory spikes on crafted patterns. Although this instance is also in the development dependency tree, it can still be abused in CI or developer tooling contexts if attacker-controlled patterns are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.2 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High
Category
Supply Chain
Confidence
88% confidence
Finding

browserslist 4.28.2 has reported crash and prototype-write/memory-growth issues when given untrusted stats or crafted query inputs. It is a tooling dependency rather than a runtime app dependency here, so the main risk is denial of service or corrupted build behavior in development/CI rather than direct production compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 145)May include surrounding context.

md
- [iTunes Search API](https://affiliate.itunes.apple.com/resources/documentation/itunes-store-web-service-search-api/)
- [Lyrics.ovh](https://lyricsovh.docs.apiary.io/)
- [MusicBrainz](https://musicbrainz.org/)
- [Radio Browser](https://api.radio-browser.info/)
- [Bandsintown](https://www.bandsintown.com/)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
- [iTunes Search API](https://affiliate.itunes.apple.com/resources/documentation/itunes-store-web-service-search-api/)
- [Lyrics.ovh](https://lyricsovh.docs.apiary.io/)
- [MusicBrainz](https://musicbrainz.org/)
- [Radio Browser](https://api.radio-browser.info/)
- [Bandsintown](https://www.bandsintown.com/)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L016-L020 将该 skill 描述为涉及“服务器配置修改”的潜在风险操作，且后文 L134-L152 专门说明“危险操作：服务器配置”。但同一文档的功能、API 端点和整体用途均围绕音乐搜索、歌词、电台和演唱会信息查询，没有任何实际功能描述支持其会修改服务器配置。这属于文档意图与所述实现范围相矛盾，而非单纯信息不完整。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The service forwards user-supplied artist and song title data to a third-party lyrics provider, which is an external data transmission not clearly bounded by user consent or privacy controls. In this app context the risk is moderate because the data is low sensitivity, but queries may still reveal user interests and create dependency on an external service's logging, retention, and availability practices.

Content

Scanner excerpt · backend/app/main.py (reported line 61)May include surrounding context.

python
# API端点配置
ITUNES_SEARCH_URL = "https://itunes.apple.com/search"
LYRICS_OVH_URL = "https://api.lyrics.ovh/v1"
MUSICBRAINZ_URL = "https://musicbrainz.org/ws/2"
RADIO_BROWSER_URL = "https://api.radio-browser.info/json"
BANDSINTOWN_URL = "https://rest.bandsintown.com"

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The radio search/top endpoints transmit user search terms and access patterns to the Radio Browser API, exposing user behavior to an external third party. While expected for a meta-search style service, this still creates privacy and supply-chain risk because availability, logging, and returned content are controlled outside the application.

Content

Scanner excerpt · backend/app/main.py (reported line 63)May include surrounding context.

python
ITUNES_SEARCH_URL = "https://itunes.apple.com/search"
LYRICS_OVH_URL = "https://api.lyrics.ovh/v1"
MUSICBRAINZ_URL = "https://musicbrainz.org/ws/2"
RADIO_BROWSER_URL = "https://api.radio-browser.info/json"
BANDSINTOWN_URL = "https://rest.bandsintown.com"

# 请求参数模型

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes the skill as a music discovery application focused on music search, lyrics, radio, and concert information. However, the media parameter explicitly allows unrelated iTunes categories including tvShow, movie, ebook, and software, expanding behavior beyond the stated music-focused scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The default search parameter sets country to CN, which imposes a locale-specific behavior by default. Under the policy, forcing a specific locale is a natural-language policy concern unless the skill offers choice or clearly documents a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The /api/search endpoint exposes a country query parameter with a default of CN, so users who do not specify a country are automatically routed to a China-specific locale. This is a locale policy issue because the code does not provide explicit opt-in or justification for the forced default.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium
Category
Supply Chain
Confidence
73% confidence
Finding

Using python-dotenv 1.0.0 is a legitimate dependency risk because the cited advisory describes symlink-following behavior in set_key that can allow arbitrary file overwrite in certain workflows. This is somewhat context-dependent and usually requires the application or administrative tooling to modify .env files, but if that path exists the issue can lead to configuration tampering or broader compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a free music discovery application focused on music search, lyrics, radio, and concert information. This file implements server-side HTTPS/TLS configuration, including reading SSL-related environment variables and building an SSL context, which is infrastructure/security capability rather than user-facing music-discovery functionality and is not declared in the stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The deployment guide includes a CORS example with allow_origins=[""], allow_methods=[""], and allow_headers=["*"] but does not warn that this is unsafe for production. Readers may copy this directly into a live deployment, unintentionally exposing the backend to cross-origin requests from arbitrary sites and increasing the attack surface for abuse or data exposure, especially when combined with credentialed requests or sensitive APIs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing instructional content in this file is written exclusively in Chinese, and the document does not offer an alternative language or indicate that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The searchMusic request hard-codes country: 'CN', which imposes a specific locale/region on all searches. This is a natural-language/policy concern because users are not offered a choice or informed that results will be constrained to a China-specific locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The root HTML element is fixed to lang="zh-CN", which enforces a specific language/locale across the application. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific, neither of which is evident in this file.

Content

No source excerpt is available for this finding.