Devialet Speaker Control

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:38 AM UTC
• Version: 1.0.0

Overview

This skill is for Devialet and Spotify playback, but it also uses desktop keystroke automation and stores Spotify tokens in ways users should review before installing.

Install only if you are comfortable letting the skill control both your Devialet speaker and Spotify playback. Prefer direct Spotify URIs or API-based playback over the search flow that uses xdotool, keep Spotify credential/token files private, revoke the Spotify app token when no longer needed, and use the Devialet HTTP controls only on a trusted local network with the correct speaker IP.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill documents shell execution capabilities such as running scripts, curl, and local desktop-control utilities, but does not declare corresponding permissions. This creates a transparency and consent problem: an agent may execute local commands affecting the host system and network without the manifest clearly disclosing that capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill claims to control Devialet speakers via HTTP API, but the documented behavior expands into Spotify auth, token storage, desktop automation, browser launch, local config access, and web lookup. This hidden expansion materially changes the trust boundary by introducing access to user accounts, local desktop state, and stored secrets beyond what a user would expect from a speaker-control skill.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The natural-language examples prominently advertise Spotify search and playback, but this capability is omitted from the manifest description. Users and security review systems could approve the skill as simple LAN speaker control while missing that it can drive third-party media services and local desktop applications.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The documentation adds dependencies like playerctl and xdotool, which enable control of local desktop applications, despite the manifest framing the skill as HTTP speaker control. Desktop automation broadens impact from a single device on the LAN to potentially arbitrary interaction with the user's logged-in session.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The 'How It Works' section shows the primary playback flow depends on Spotify desktop app control via D-Bus/MPRIS and URI opening, not only the Devialet HTTP API. That discrepancy can mislead users about what software and privileges the skill uses, reducing informed consent and increasing the chance of unsafe deployment.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script’s behavior extends beyond controlling a Devialet speaker and directly manipulates the local Spotify desktop session over D-Bus, including search and playback actions. In an agent skill context, this broadens the trust boundary from a networked speaker to the user’s desktop session, creating unexpected side effects and increasing the risk of unauthorized local automation.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The script sends user-provided song queries to Google search, which is unrelated to direct speaker control and causes external transmission of user input to a third party. This can leak listening intent or other sensitive text the user supplied, and it introduces nondeterministic behavior based on scraped web results.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Using xdotool to inject a Return key into the desktop session is dangerous because it targets the active GUI context, not a securely scoped Spotify control channel. If focus is on another window, the keystroke can trigger unintended actions such as confirming dialogs, sending messages, or interacting with unrelated applications.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script’s declared purpose is Devialet speaker control, but it actually initiates Spotify OAuth, stores Spotify credentials, and controls Spotify playback devices. This mismatch is security-relevant because users may grant account access and run networked account-control code they did not reasonably expect from the skill manifest.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The operational code performs Spotify account/device enumeration and playback control against api.spotify.com rather than controlling Devialet speakers through the described local HTTP API. In a skill ecosystem, this kind of capability mismatch can mislead users into authorizing unrelated external services and expands the trust boundary to a third-party cloud account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly instructs use of an HTTP API with no authentication, meaning any host on the same network can observe or modify speaker control traffic and issue commands such as source switching, muting, volume changes, or power off. Although this appears to be describing a vendor limitation rather than intentionally introducing abuse, the lack of a prominent warning near the usage examples understates the integrity and privacy risks to users deploying the skill.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The OAuth token response is written to a local token file containing access and refresh credentials without any prominent warning, consent prompt, or file-permission hardening. If another local user or process can read that file, it could reuse the tokens to control the victim’s Spotify playback and maintain access via refresh.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.