ClawHub
Back to skill

Security audit

Mopidy

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Mopidy music controller, with some transport-security and queue-changing caveats but no evidence of hidden, unrelated, persistent, or malicious behavior.

Install this only for a Mopidy server you trust. Prefer a local or properly certificate-validated HTTPS MOPIDY_URL, and be aware that some helper commands currently bypass certificate checks. Also treat play-track and clear as queue-replacing actions.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mopidy.sh:41
Finding

Disabled TLS Certificate Verification for Mopidy JSON-RPC Requests

Content
View full analysis
&2; exit 1; } jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL" ;; add-track) uri="${1:-}" [ -n "$uri" ] || { echo "track uri required" >&2; exit 1; } jq -nc --arg uri "$uri" '{jsonrpc:"2.0",id:1,method:"core.tracklist.add",params:{uris:[$uri]}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL" ;; add-album) uri="${1:-}" [ -n "$uri" ] || { echo "album uri required" >&2; exit 1; } jq -nc --arg uri "$uri" '{jsonrpc:"2.0",id:1,method:"core.tracklist.add",params:{uris:[$uri]}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL" ;; add-playlist-to-queue) uri="${1:-}" [ -n "$uri" ] || { echo "playlist uri required" >&2; exit 1; } lookup=$(jq -nc --arg uri "$uri" '{jsonrpc:"2.0",id:1,method:"core.playlists.lookup",params:{uri:$uri}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL") uris=$(printf '%s' "$lookup" | jq '[.result.tracks[].uri]') jq -nc --argjson uris "$uris" '{jsonrpc:"2.0",id:1,method:"core.tracklist.add",params:{uris:$uris}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL" ;; play) rpc '{"jsonrpc":"2.0","id":1,"method":"core.playback.play"}' ;; play-track) uri="${1:-}" [ -n "$uri" ] || { echo "track uri required" >&2; exit 1; } rpc '{"jsonrpc":"2.0","id":1,"method":"core.tracklist.clear"}' >/dev/null jq -nc --arg uri "$uri" '{jsonrpc:"2.0",id:1,method:"core.tracklist.add",params:{uris:[$uri]}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL" >/dev/null rpc '{ ...[truncated 2546 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes shell-capable helper scripts (scripts/mopidy.sh, scripts/match_top_tracks.py) and depends on external binaries, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may execute shell commands more broadly than intended, increasing the chance of unintended command execution or misuse of networked capabilities against the Mopidy endpoint or the web-search workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/match_top_tracks.py (reported line 21)May include surrounding context.

python
for song in songs:
    query = f"{artist} {song}"
    try:
        raw = subprocess.check_output(base_cmd + [query], text=True)
        data = json.loads(raw)
        tracks = data.get("result", [{}])[0].get("tracks", [])
    except Exception:

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 12)May include surrounding context.

sh
rpc() {
  local payload="$1"
  curl -sS -H 'Content-Type: application/json' -d "$payload" "$MOPIDY_URL"
}

usage() {

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 54)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 59)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 64)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 69)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 71)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mopidy.sh (reported line 80)May include surrounding context.

sh
search)
    q="${*:-}"
    [ -n "$q" ] || { echo "search query required" >&2; exit 1; }
    jq -nc --arg q "$q" '{jsonrpc:"2.0",id:1,method:"core.library.search",params:{query:{any:[$q]},uris:null,exact:false}}' | curl -ksS -H 'Content-Type: application/json' -d @- "$MOPIDY_URL"
    ;;
  add-track)
    uri="${1:-}"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Several commands use curl with '-k', disabling TLS certificate verification when talking to the Mopidy JSON-RPC endpoint. This allows a man-in-the-middle or malicious network device to impersonate the server, read requests, and tamper with playback-control operations or returned playlist/search data; in a home-lab context this may seem routine, but the skill explicitly supports remote HTTPS endpoints via MOPIDY_URL, so bypassing certificate validation materially weakens transport security.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The play-track command silently clears the existing tracklist before adding the requested track, which can discard the user's current queue state. Although the script has a usage block, there is no inline warning, confirmation, or user-facing notice at the point where this destructive action occurs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.