ClawHub
Back to skill

Security audit

Music Player for Windows

Security checks for vulnerabilities and agentic risk

Overview

The skill’s music features look legitimate, but its install path uses mutable and unpinned dependencies that should be reviewed before installation.

Review the install steps before using this skill. Prefer a pinned release, pin Python dependencies in a Python dependency file, remove unused dependencies, and save downloads only to a dedicated music folder to avoid overwriting important files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:19
Finding

Unpinned, Mutable, and Unnecessary Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该发布指南从标题到全部操作说明均仅使用中文，没有提供用户可选择的语言或说明这是面向特定中文用户群的受限文档。按规则，强制特定语言而未提供用户选择属于自然语言层面的语言/区域策略违规。

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx clawhub@latest install music-player, which fetches and executes the latest published package version rather than a reviewed, pinned release. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious update is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README directs users to run a script that downloads remote music content and writes it to an arbitrary user-specified file path, but it does not clearly warn about these side effects. In a skill context, undisclosed network access and filesystem writes increase the chance of unintended data placement, overwriting files, or users invoking the tool without understanding its trust and permission implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The title and description are written entirely in Chinese, and all usage guidance assumes Chinese-language interaction. For a general music-player skill, this creates a language/locale constraint without user opt-in or a documented region-specific justification, which matches the policy-violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file's docstrings, usage text, status messages, and result output are all hard-coded in Chinese, which imposes a specific language on users. Under the policy, locale or language constraints should either be optional/opt-in or clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all user-facing print strings are written in Chinese, which imposes a specific language on users. Under the policy, locale or language restrictions should either be optional or explicitly justified as region-specific; this file does neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s natural-language strings and docstrings are entirely in Chinese, including the skill title and user-facing status messages. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This file is a code file, so SQP-3 applies. The USLT frame is always written with the Chinese language code, which imposes a locale-specific behavior regardless of the actual lyrics language and without any opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all user-facing messages are written exclusively in Chinese, which imposes a specific language on all users. The file does not provide any opt-in, fallback language option, or documented reason that the skill is intended only for a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · play_music.py (reported line 29)May include surrounding context.

python
return True
        # macOS: 使用 afplay
        elif sys.platform == 'darwin':
            subprocess.run(['afplay', file_path])
            return True
        # Linux: 使用 aplay 或 paplay
        else:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · play_music.py (reported line 33)May include surrounding context.

python
return True
        # Linux: 使用 aplay 或 paplay
        else:
            subprocess.run(['aplay', file_path])
            return True
    except Exception as e:
        print(f"播放失败：{e}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script accepts an arbitrary output path from the user and writes to it with open(save_path, 'wb') without checking whether the file already exists or prompting before overwriting. In an agent or automated execution context, this can destroy existing local files or place downloaded content into sensitive locations if the path is influenced by upstream input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language description is presented in Chinese and the usage examples are centered on Chinese-language interaction, while the document does not offer an English or user-selected language option. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description is written as a Windows Chinese-language skill description ("Windows 音乐播放技能") with no indication that other languages are supported or that the user can opt into this locale. The policy calls for flagging language or locale constraints when they are imposed without documented choice or justification.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

Using a wildcard version for requests allows installation of any present or future release, including breaking or compromised versions introduced through the supply chain. Because this skill appears to download and process external content, dependency drift increases the chance of pulling in a vulnerable package version that could affect network operations or file handling.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json
"metadata": "python embed_metadata.py"
  },
  "dependencies": {
    "requests": "*",
    "mutagen": "*",
    "python-pptx": "*"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

Using mutagen with a wildcard version makes builds non-reproducible and exposes consumers to unreviewed upstream changes, including security regressions in media metadata parsing. Since this skill embeds metadata into music files, parser-related vulnerabilities could become relevant if a bad dependency version is fetched.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
},
  "dependencies": {
    "requests": "*",
    "mutagen": "*",
    "python-pptx": "*"
  },
  "python_version": ">=3.7",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

Wildcard dependency resolution for python-pptx permits arbitrary future versions to be installed, creating supply-chain risk and reducing reproducibility. Although the package purpose does not clearly justify this dependency, if it is used anywhere in the skill, an unpinned document-processing library can expand the attack surface for malformed file handling or compromised releases.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"dependencies": {
    "requests": "*",
    "mutagen": "*",
    "python-pptx": "*"
  },
  "python_version": ">=3.7",
  "platform": [