Devialet Speaker Control

• Analyzed: May 12, 2026, 3:08 AM
• Findings: 1
• Version: 1.0.0
• Hash: 286a83574f10f88916779ef0457cb1b262581ab960adf9effe73682a315b1a32
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `xdotool` in `scripts/play-on-devialet.sh`. While currently used for a benign purpose (simulating a 'Return' key press to interact with the Spotify desktop application), `xdotool` grants the agent the capability to perform arbitrary desktop automation, including simulating keyboard and mouse input. This high-risk capability, combined with `export DISPLAY=:0`, could be exploited via prompt injection to execute unauthorized actions on the user's graphical environment, even though there is no clear evidence of intentional malicious behavior within the provided files.