Security audit
Sonos 音乐点播
Security checks for vulnerabilities and agentic risk
Overview
This Sonos music playback skill matches its stated purpose and only performs disclosed local setup for Sonos/SoCo playback.
Install only if you trust the local sonos CLI and are comfortable with a Python venv being created at $HOME/.openclaw/venvs/soco-sonos and soco being installed from Python packaging sources. Before playback, inspect the separate sonos_netease_play and sonos_qq_play wrapper/Python files in your workspace because this package checks for them but does not include them.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.