Devialet Speaker Control

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:46 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches speaker control, but it also includes under-disclosed Spotify account automation and insecure token handling that users should review before installing.

Install only if you are comfortable granting Spotify playback-control access and letting the skill automate your local Spotify desktop session. Keep Devialet control limited to a trusted LAN, review or remove spotify.sh if you do not need OAuth-based Spotify control, and fix token permissions plus volume input validation before relying on it in automation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/devialet.sh:131

Finding

Command Execution Through Unsafe Bash Arithmetic Evaluation

Content

View full analysis

Remediation

View remediation

100 )); then echo "Error: Volume must be an integer from 0 to 100" exit 1 fi ``` The `10#` prefix forces base-10 interpretation and avoids octal handling of values with leading zeroes. Apply the same strict validation to every user-controlled value used in arithmetic expressions or JSON request bodies. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/spotify.sh:56

Finding

Spotify OAuth Secrets Exposed in Process Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/spotify.sh:69

Finding

Spotify Access and Refresh Tokens Written Without Enforced Restrictive Permissions

Content

View full analysis

"${SPOTIFY_TOKEN}.tmp" && mv "${SPOTIFY_TOKEN}.tmp" "$SPOTIFY_TOKEN" ``` Initial authentication writes the OAuth response directly: ```bash echo "$response" | jq --arg ea "$((now + expires_in - 60))" '. + {expires_at: ($ea | tonumber)}' > "$SPOTIFY_TOKEN" ``` The storage paths are configured as follows: ```bash CONFIG_DIR="${XDG_CONFIG_HOME:-$HOME/.config}/clawdbot" SPOTIFY_CREDS="$CONFIG_DIR/spotify.json" SPOTIFY_TOKEN="$CONFIG_DIR/spotify_token.json" ``` ### Technical Analysis The token file contains an access token and normally a reusable refresh token. The script creates and replaces this file without setting a restrictive process umask, explicitly creating the file with mode `0600`, or validating permissions on the containing directory. Consequently, the resulting permissions depend on the caller's current umask and pre-existing directory configuration. With a permissive umask, the token or temporary token file can be group-readable or world-readable. The temporary file used during refresh creates an additional exposure point. The same configuration directory also contains `spotify.json`, which the documented setup expects to hold the Spotify client secret, but the script does not validate that file's permissions. ### Attack Path 1. A user runs the authentication flow under a permissive umask or with an inadequately protected configuration directory. 2. The script writes `spotify_token.json` or `spotify_token.jso ...[truncated 892 chars]

Remediation

View remediation

"$tmp_file" mv -f "$tmp_file" "$SPOTIFY_TOKEN" chmod 600 "$SPOTIFY_TOKEN" ``` Also: - Verify that `$CONFIG_DIR`, `spotify.json`, and `spotify_token.json` are owned by the current user and are not symbolic links. - Reject unsafe permissions rather than silently continuing. - Install a trap to remove temporary files on failure or interruption. - Recommend revoking and regenerating tokens if prior files may have been readable by other users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the implementation truly uses Spotify OAuth, token storage, and Spotify Web APIs as described by the finding, that would materially exceed the stated Devialet HTTP-control scope and introduce credential-handling risk. However, this specific SKILL.md content does not clearly show OAuth flows or token storage, so part of the finding appears overstated relative to the visible file.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the implementation truly uses Spotify OAuth, token storage, and Spotify Web APIs as described by the finding, that would materially exceed the stated Devialet HTTP-control scope and introduce credential-handling risk. However, this specific SKILL.md content does not clearly show OAuth flows or token storage, so part of the finding appears overstated relative to the visible file.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

./scripts/play-on-devialet.sh "Drake - God's Plan"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script materially expands the stated Devialet HTTP API skill into Spotify OAuth and remote Spotify account/device control, which is outside the declared purpose. This mismatch is dangerous because users may grant third-party account permissions and execute unintended internet-connected actions under the assumption they are only controlling local speakers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/spotify.sh (reported line 37)May include surrounding context.

sh

CLIENT_SECRET=$(jq -r '.client_secret' "$SPOTIFY_CREDS")
}

# Get valid access token (refresh if needed)
get_token() {
    if [[ ! -f "$SPOTIFY_TOKEN" ]]; then
        echo "Error: Not authenticated. Run: $0 auth"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill documents shell-based execution paths (curl, script invocation, package installation) but declares no explicit tool scope or allowed-tools boundary. In an agent environment, this broadens what the agent may attempt without least-privilege constraints, increasing the risk of unintended command execution or network actions beyond the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description omits the documented Spotify search/play functionality, which means users and reviewers are not given an accurate picture of the skill's external-service interactions. Hidden or under-disclosed capability is a security concern because it can lead to inappropriate approval of network, desktop, or account-linked behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill as HTTP-based speaker control, while the body explains that playback works by searching in Spotify and opening URIs in the Spotify app. This discrepancy can mislead operators about the trust boundary, causing them to underestimate external-service usage, local application control, and data flow outside the local network.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation introduces playerctl and xdotool, which enable control of local desktop media sessions and GUI automation, far beyond a narrow speaker HTTP API. In context, this increases the attack surface from a LAN device controller to a local workstation automation tool, which can be abused to manipulate user applications or input.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

- **Devialet speaker** with DOS 2.14+ or SDOS 1.3+ firmware
- **Spotify integration** (optional):
  - Spotify desktop app running and logged in
  - `playerctl` and `xdotool` installed (`sudo apt install playerctl xdotool`)
  - Speaker set as Spotify Connect device (select once in Spotify app)

## How It Works

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

bash

# Volume (0-100)
curl -X POST -H "Content-Type: application/json" \
  -d '{"volume": 50}' \
  "http://$DEVIALET_IP/ipcontrol/v1/systems/current/sources/current/soundControl/volume"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation exposes that the device control API uses plain HTTP and requires no authentication, enabling anyone on the same network segment to issue state-changing commands such as volume changes, source switching, mute, playback control, and power-off. In a skill context that helps users operate these endpoints, the lack of a prominent security warning increases the likelihood of unsafe deployment on shared or untrusted networks, leading to unauthorized device manipulation and privacy or availability issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/devialet.sh (reported line 100)May include surrounding context.

sh

post() {
    local endpoint="$1"
    local data="${2:-{}}"
    curl -s -H 'Content-Type: application/json' -X POST -d "$data" "${BASE_URL}${endpoint}" | $FORMAT
}

# Handle discover command specially (no host required)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes controlling Devialet Phantom speakers via the Devialet HTTP API for play/pause, volume, mute/unmute, source selection, and status. This script also automates a local Spotify client via D-Bus/playerctl/xdotool, performs Google web searches for tracks, and opens Spotify URIs, which is broader than merely controlling the speaker through its HTTP API.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends user-provided song queries to Google, which transmits potentially sensitive listening intent or user-entered text to an unrelated third party outside the stated Devialet control scope. This creates an unexpected data disclosure channel and broadens the trust boundary, especially because users may assume only local speaker control is occurring.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Using xdotool to inject a Return key into the active GUI session can affect whichever window has focus, not necessarily Spotify, causing unintended actions in other applications. In a desktop automation context this is dangerous because it crosses application boundaries and can trigger unpredictable user-interface side effects without robust targeting or consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/play-on-devialet.sh (reported line 114)May include surrounding context.

sh

volume|vol)
        if [[ -n "$ARG2" ]]; then
            echo "Setting volume to $ARG2%"
            curl -s -X POST -H "Content-Type: application/json" \
                -d "{\"volume\": $ARG2}" \
                "http://$DEVIALET_IP/ipcontrol/v1/systems/current/sources/current/soundControl/volume" &>/dev/null
            echo "Volume: $ARG2%"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/spotify.sh (reported line 52)May include surrounding context.

sh

load_creds
        local refresh_token=$(jq -r '.refresh_token' "$SPOTIFY_TOKEN")
        
        local response=$(curl -s -X POST "https://accounts.spotify.com/api/token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "grant_type=refresh_token&refresh_token=$refresh_token&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/spotify.sh (reported line 107)May include surrounding context.

sh

load_creds
        local refresh_token=$(jq -r '.refresh_token' "$SPOTIFY_TOKEN")
        
        local response=$(curl -s -X POST "https://accounts.spotify.com/api/token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "grant_type=refresh_token&refresh_token=$refresh_token&client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The OAuth flow introduces third-party account authorization and persistent control over a user's Spotify playback without that capability being justified by the advertised Devialet-only purpose. In skill ecosystems, undeclared account-linking behavior increases phishing, overpermission, and user-consent risk because users are not expecting external credential workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.