T08 · Insecure Dependencies
Warning
- Location
api.md:45- Finding
Unpinned Community Dependencies Receive an Account Authentication Token
- Content
View full analysis
- Remediation
View remediation
Security audit
Udio
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed Udio music helper, but it asks users to copy a live browser session token into unofficial, unpinned community wrappers.
Install only if you are comfortable extracting a Udio browser session token and giving it to unofficial community wrapper code. Prefer prompt-only or browser-only use if you do not need automation, review and pin any wrapper versions before installation, run them in an isolated environment, and do not store creative project details or token locations unless you want that local history retained.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (16)
YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]
High
- Category
- YARA Match
- Confidence
- 88% confidence
- Finding
Installing directly from a Git URL bypasses normal package-registry review and encourages execution of code fetched from a remote repository at install time. In a skill already centered on unofficial community wrappers and session-token usage, this increases supply-chain risk because a compromised repo or dependency could execute malicious code and steal the user's auth token.
- Content
eric-password -a udio -s udio_auth_token -w
text **Never store tokens in plain text files or commit to git.** ### Token Expiration Tokens expire after ~7 days of inactivity. If you get 401 errors: 1. Log into udio.com again 2. Re-extract the token from cookies 3. Update your environment variable ## Python Wrapper (udio_wrapper) ### Installation ```bash pip install udio_wrapper # or from source pip install git+https://github.com/flowese/UdioWrapper.gitBasic Usage
python from udio_wrapper import UdioWrapper udio = UdioWrapper(auth_token) # Create a song (~30 seconds) result = udio.create_song( prompt="electronic ambient chill downtempo synth pads warm", seed=-1, # -1 = random seed custom_lyrics=None # Optional ) print(f"Song ID: {result['id']}") print(f"Audio URL: {result['song_path']}")Extend a Song
python # Extend the first clip to ~1 minute extended = udio.extend( prompt="add subtle drums and bass, maintain atmosphere", seed=-1,
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs users to extract a live Udio authentication token from browser cookies and reuse it outside the browser session. That exceeds the stated music-generation purpose and turns the skill into a credential-handling guide, increasing risk of account takeover, unauthorized API use, and secret leakage through logs, prompts, terminals, or downstream tools.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation tells the user to copy a sensitive auth token from browser storage without any prominent warning that this token is equivalent to a live session credential. Even if the intent is convenience, normalizing manual extraction of session secrets makes accidental disclosure and unsafe storage far more likely.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill describes harvesting a live authentication token from cookies and reusing it later, which is effectively session-token exfiltration and persistence. A stolen or mishandled token could let another process or person impersonate the user until the token expires or is revoked.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The Keychain command by itself is not inherently malicious, but in this context it is used to persist a copied live session token for later retrieval. Persisting a browser session token as a reusable secret extends the exposure window and facilitates repeated unauthorized use if the host or scripts are compromised.
- Content
Store Securely
bash # macOS Keychain security add-generic-password -a udio -s udio_auth_token -w "paste-token-here" -U # Retrieve later
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Approach method: api | browser | prompt-only wrapper: python | node | none token_location: keychain:udio_auth_token | env:UDIO_AUTH_TOKEN | none ## Preferences
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Approach method: api | browser | prompt-only wrapper: python | node | none token_location: keychain:udio_auth_token | env:UDIO_AUTH_TOKEN | none ## Preferences
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Approach method: api | browser | prompt-only wrapper: python | node | none token_location: keychain:udio_auth_token | env:UDIO_AUTH_TOKEN | none ## Preferences
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Approach method: api | browser | prompt-only wrapper: python | node | none token_location: keychain:udio_auth_token | env:UDIO_AUTH_TOKEN | none ## Preferences
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Approach method: api | browser | prompt-only wrapper: python | node | none token_location: keychain:udio_auth_token | env:UDIO_AUTH_TOKEN | none ## Preferences
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## Security Note **Never save auth tokens in plain text.** Guide users to: - macOS: Use Keychain (`security add-generic-password`) - Linux: Use secret-tool or encrypted file - Windows: Use Credential Manager
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs users to extract a live browser session token from cookies and use it with unofficial wrappers, but the warning at the moment of extraction is too weak for the sensitivity of the credential. A session bearer token can grant direct account access and API actions as the user, so normalizing manual token harvesting materially increases account-compromise and misuse risk.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template explicitly directs storing exact successful prompts, seeds, and project details in a persistent markdown memory file. Even if not obviously sensitive, user prompts and music project metadata can contain personal, proprietary, or commercially sensitive information, and retaining them verbatim increases privacy and data exposure risk if the local store is accessed or reused beyond user expectations.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction to 'gather info opportunistically' encourages ongoing collection of user preference data without defining scope, necessity, or stopping conditions. This can lead to over-collection of behavioral data and creation of a broader user profile than needed for the immediate task, raising privacy and compliance concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly instructs persistent storage of user preferences, styles, seeds, and project history in ~/udio/memory.md without requiring clear user notice or consent. Even if the data is not highly sensitive by default, it can reveal creative projects, commercial intent, behavioral preferences, and workflow details, creating privacy and data-retention risk on shared or insecure systems.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The section explicitly labels English as the default and states it works best, which imposes a language preference in the skill's natural-language guidance. Under the policy, forcing or preferring a specific language without user opt-in can be a locale/language policy violation.
- Content
Static analysis
No suspicious patterns detected.