Sonos Netease Playback

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 0.1.1

Overview

This skill is a disclosed Sonos playback setup helper; it changes local setup files and installs a Python dependency, but I found no hidden or purpose-mismatched behavior.

Install only if you are comfortable with it creating a local Python virtual environment, installing the SoCo package from your configured pip source, and creating or chmod-ing a Sonos playback wrapper in your workspace. Prefer reviewing or pinning dependencies before use in stricter environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/bootstrap_env.sh:29

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: scripts/bootstrap_env.sh, lines 29–36
Vulnerability Type: Supply-chain exposure caused by unpinned dependencies and mutable package sources
Risk Level: Medium

zsh

status "ensuring pip exists"
"$PYTHON_BIN" -m ensurepip --upgrade >/dev/null 2>&1 || true

status "ensuring soco is installed"
if ! "$PYTHON_BIN" -c 'import soco' >/dev/null 2>&1; then
  "$PIP_BIN" install --upgrade pip soco
fi

Technical Analysis

The bootstrap script installs the latest available versions of pip and soco without version constraints, a lock file, or cryptographic hashes. It also relies on pip's configured package index rather than explicitly enforcing a reviewed HTTPS source.

Consequently, the installed artifacts can change between executions. A compromised upstream release, package repository, dependency, package-index configuration, or network trust boundary could cause attacker-controlled Python code to be installed. The script's preliminary import soco check also executes the installed package to determine whether installation is needed.

Attack Path

1. An attacker compromises a relevant package release, transitive dependency, configured package index, or package-delivery trust boundary.
2. The user runs scripts/install.sh, which invokes scripts/bootstrap_env.sh.
3. If soco is not importable, the script executes pip install --upgrade pip soco.
4. Pip resolves and installs mutable, unverified package versions from its configured source.
5. Attacker-controlled package code can execute when soco is imported by the bootstrap check or subsequent playback workflow.

Exploitation depends on compromise or malicious configuration of the external dependency supply chain; the audited project itself does not contain an embedded malicious payload.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running the installe ...[truncated 337 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pip, soco, and all transitive dependencies to reviewed versions.
• Generate and maintain a lock or requirements file containing SHA-256 hashes.
• Install with --require-hashes, for example:

  zsh

  "$PYTHON_BIN" -m pip install \
    --require-hashes \
    --only-binary=:all: \
    -r "$SKILL_DIR/requirements.lock"
  

• Explicitly enforce an approved HTTPS package index rather than inheriting an arbitrary user or system pip configuration.
• Avoid silently upgrading pip during bootstrap; provision a reviewed, pinned version instead.
• Perform dependency vulnerability and provenance checks when updating the lock file.
• Consider validating installation metadata without importing untrusted package code during the bootstrap process.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill clearly instructs the agent to execute shell commands such as install, check, bootstrap, and playback scripts, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. In agent environments, this can lead to over-broad shell access being implicitly granted, making it easier for a skill to trigger installation, environment modification, or arbitrary command execution without transparent authorization controls.

Content

No source excerpt is available for this finding.