RoomSound

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:39 PM UTC
• Version: 0.1.5

Overview

RoomSound appears purpose-aligned for audio playback, but it asks agents to make automatic package, playback, Bluetooth, and persistent configuration changes with insufficient user control.

Review this skill before installing. It is not evidence of theft or destructive behavior, but it can install packages, alter audio/Bluetooth state, start long playback queues, and write persistent configuration. Only use it if you are comfortable approving each setup or repair action, and prefer a version that validates URLs and uses mpv -- before user-provided media arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:55

Finding

MPV Option Injection Through User-Supplied Media Arguments

Content

View full analysis

"`. - If user gives search text, run: - `yt-dlp --print "%(title)s | Duration: %(duration_string)s | Uploaded: %(upload_date>%Y-%m-%d)s | https://youtu.be/%(id)s" "ytsearch5:"` - Search output includes title, duration, upload date, and URL; prefer newest or user-confirmed result when ambiguity exists. ### YouTube Playback Command Contract - Required binaries: `yt-dlp` and `mpv`. - On missing binary, return a clear install hint and run dependency initialization: - `Error: yt-dlp not found. Install with: sudo apt install yt-dlp` - `Error: mpv not found. Install with: sudo apt install mpv` - If user provides a specific list of URLs, queue all in order with one command: - `mpv --no-video "" "" "" ...` - If user requests a specific list but provides titles/queries, resolve each item and queue in order: - `yt-dlp -f bestaudio -g "ytsearch1:"` ... `yt-dlp -f bestaudio -g "ytsearch1:"` - then `mpv --no-video "" "" ...` ``` The related sanitization requirement at `SKILL.md`, line 131, only removes selected shell metacharacters: ```markdown - **Input sanitisation**: before interpolating any user-supplied text into a shell command, strip shell metacharacters (`` ` ``, `$`, `(`, `)`, `{`, `}`, `|`, `;`, `&`, `<`, `>`, `\`, `'`, `"`) to prevent command injection. ``` ### Technical Analysis The documented commands pass user-supplied URLs directly to `mpv` without an option terminator. Shell quoting prevents whitespace splitting and ordinary shell metacharacter interpretation, but it does not prevent the invoked program from interpreting an argument beginning with `-` or `--` as a command-line option. Consequently, an input s ...[truncated 2136 chars]

Remediation

View remediation

" ``` For queues: ```bash mpv --no-video -- "" "" "" ``` 3. Apply the same validation to stream URLs returned by `yt-dlp`, even though those values are normally tool-generated. 4. Avoid blacklist-based sanitization as the primary defense. Preserve legitimate URL characters while enforcing expected structure and invoking commands through an argument-array API rather than a shell where supported. 5. Add regression tests covering: - `--script=/path/file.lua` - `--config-dir=/path` - `-v` - URLs containing spaces or shell metacharacters - Valid HTTP and HTTPS media URLs 6. Run MPV with the least-privileged account practical and restrict access to sensitive local files to reduce impact if another MPV option-handling issue is discovered. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide explicitly instructs users to let the agent initialize the system and approve package installation prompts, but it does not clearly describe what packages may be installed, what system changes will occur, or what permissions are required. In an agentic environment, vague setup language can normalize broad system modification and increase the chance that users approve risky or unnecessary changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide tells users that the agent should run technical fixes automatically when failures occur, without warning that troubleshooting may involve package changes, service restarts, device reconfiguration, or other system-affecting actions. This encourages trust in opaque autonomous remediation, which can be abused or can lead to unintended changes on the host system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill’s activation and execution scope is broad enough that an agent could initiate device discovery, package installation, Bluetooth switching, or playback actions from loosely related user prompts. Because the skill is an execution layer tied to shell commands and persistent configuration changes, weak trigger boundaries increase the chance of unintended or over-privileged actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs the agent to persistently write configuration into ~/.config/yt-dlp/config, modifying future behavior outside the current session. Persistent state changes are security-relevant because they alter downstream command execution and can create hard-to-audit side effects, especially when done automatically on first run.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Run one-time validation:
     `yt-dlp --js-runtimes "node:/usr/bin/nodejs" --print "%(title)s | Uploaded: %(upload_date>%Y-%m-%d)s | https://youtu.be/%(id)s" "ytsearch5:tiesto prismatic"`
   - Persist config:
     `mkdir -p ~/.config/yt-dlp && printf '%s\n' '--js-runtimes node:/usr/bin/nodejs' > ~/.config/yt-dlp/config`
4. Detect speakers using:
  - `bluetoothctl paired-devices`
  - `bluetoothctl info <MAC>`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

### YouTube Playback Command Contract
- Required binaries: `yt-dlp` and `mpv`.
- On missing binary, return a clear install hint and run dependency initialization:
  - `Error: yt-dlp not found. Install with: sudo apt install yt-dlp`
  - `Error: mpv not found. Install with: sudo apt install mpv`
- If user provides a specific list of URLs, queue all in order with one command:
  - `mpv --no-video "<url1>" "<url2>" "<url3>" ...`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

### YouTube Playback Command Contract
- Required binaries: `yt-dlp` and `mpv`.
- On missing binary, return a clear install hint and run dependency initialization:
  - `Error: yt-dlp not found. Install with: sudo apt install yt-dlp`
  - `Error: mpv not found. Install with: sudo apt install mpv`
- If user provides a specific list of URLs, queue all in order with one command:
  - `mpv --no-video "<url1>" "<url2>" "<url3>" ...`

Static analysis

No suspicious patterns detected.