Security audit

Mopidy Party Mode

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Mopidy party-mode controller, but users should ensure host-only playback controls are actually enforced.

Install this only where the assistant can reliably tell host requests from guest requests and require explicit host approval before play, pause, skip, clear, or play-track. Consider splitting host controls from guest-safe queue actions if the skill will be used in open group chats.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script exposes host-only disruptive playback controls (`play`, `pause`, `next`, `previous`, `clear`) even though the skill is described as party mode where guests should only search, inspect the queue, and add music. In a shared/group-chat context, this mismatch can let untrusted participants disrupt playback or bypass the intended approval boundary if the agent invokes the script directly.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: `play-track` first clears the tracklist and then starts playback of a single track, which directly defeats the shared-queue semantics promised by party mode. In practice, one invocation can erase all queued contributions from other users and seize playback immediately, making it especially dangerous in a group environment.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The queue-clearing step inside `play-track` is destructive and silent: it discards the existing queue with no confirmation, warning, or audit signal. Because this skill is intended for collaborative queue building, silent deletion of queued items increases the chance of accidental or unauthorized disruption.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `clear` command irreversibly wipes the queue and is presented in the same interface as guest-safe operations, with no warning in usage text or runtime output. In the stated party-mode context, that makes accidental misuse or unauthorized disruption materially more likely.

Static analysis

No suspicious patterns detected.