ClawHub
Back to skill

Security audit

audd-musikerkennung

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AudD music-recognition and account-management skill, with expected third-party audio/API use and useful safeguards around tokens, billing, and irreversible actions.

Install only if you are comfortable using AudD as an external service for audio recognition. Do not provide private recordings, internal URLs, callback endpoints, or API tokens unless the task requires it; prefer OAuth or a secure vault, review requested MCP scopes carefully, and confirm before stream setup, paid-plan actions, token reads, or token rotation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill explicitly instructs obtaining, storing, rotating, and moving an api_token via clipboard, secret vault, MCP token reads, environment variables, and .env files. This meaningfully expands credential-access behavior inside the skill, increasing the chance of secret exposure through chat, model context, shell history, repo files, or insecure local storage paths.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: "audd-musikerkennung"
description: "Musikerkennung und AudD-Kontoverwaltung über den offiziellen AudD-MCP-Server (https://mcp.audd.io) und/oder die direkte HTTP-API. Ein eigener api_token ist optional — funktioniert per OAuth-MCP ganz ohne Token, mit Trial-Plan und mit bezahltem Plan, ebenso mit dauerhaft hinterlegtem Token. Nutze diesen Skill bei Songerkennung — \"welcher Song ist das?\", Audio-Clip oder Datei identifizieren, Shazam-artig, Radio-/Twitch-/YouTube-Streams überwachen, DJ-Sets, Podcasts oder Videos nach Tracks durchsuchen, Tracklists, Airplay-Monitoring, Copyright-Check — und bei allem rund um das AudD-Konto: api_token eintragen, hinterlegen, aus der Zwischenablage in den Secret-Vault übernehmen, in .env setzen, rotieren; Request-Kontingent, Verbrauch, Trial-Restlaufzeit, Plan-Upgrade, Rechnungen. Auch anwenden, wenn AudD nicht namentlich genannt wird, aber ein Audio-/Video-Link oder eine lokale Audiodatei identifiziert werden soll."
---

# AudD Musikerkennung

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation text is overly broad and explicitly says to use the skill even when AudD is not named, including for generic audio/video links and local files. That can cause the agent to invoke this skill for unrelated media tasks and send user-provided content or metadata to external AudD services without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This section establishes that the skill sends data to external AudD endpoints, including uploaded binary audio and URLs for server-side retrieval. Any invocation can therefore transmit user media, links, and possibly account-associated request metadata to a third party, creating privacy and data-handling risk if not explicitly consented to.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
Zwei Zugänge, die sich ergänzen:

- **MCP-Server** (`https://mcp.audd.io`) — OAuth-authentifiziert, kennt das Konto. Braucht **keinen** api_token.
- **HTTP-API** (`https://api.audd.io/`, `https://enterprise.audd.io/`) — braucht einen `api_token`, dafür kann sie Binärdateien hochladen und große Dateien verarbeiten.

## Betriebsmodi — der Token ist optional

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

The HTTP API description confirms direct submission of audio sources and api_token to a third-party service. Because this endpoint supports URLs, files, and base64 audio, the skill enables broad outbound transfer of potentially sensitive media content beyond the local environment.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
### Standard-Endpunkt: kurze Clips bis 10 MB

`https://api.audd.io/` — Antwortzeit etwa 0,1 bis 1,5 Sekunden.

Parameter: `api_token` (Pflicht), dazu genau eine Audioquelle — `url` (HTTP-URL, von AudD serverseitig geladen), `file` (multipart/form-data) oder `audio` (base64, von AudD ausdrücklich nicht empfohlen). Optional: `return` als kommaseparierte Liste aus `apple_music`, `spotify`, `deezer`, `musicbrainz`, und `market` als Ländercode (Standard `us`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The example shows user-supplied audio URLs being forwarded to the external AudD API along with authentication. If an agent follows this pattern automatically, it may disclose private or internal URLs and trigger third-party fetching of resources the user did not intend to expose externally.

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

bash
# per URL
curl https://api.audd.io/ \
  -F url='https://audd.tech/example.mp3' \
  -F return='apple_music,spotify' \
  -F api_token="$AUDD_API_TOKEN"

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This example instructs direct upload of a local file to an external endpoint, which is a clear data exfiltration path for local content. In an agent setting, local files may contain sensitive recordings, meetings, or copyrighted material, making unintended disclosure plausible and harmful.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

-F api_token="$AUDD_API_TOKEN"

lokale Datei

curl https://api.audd.io/
-F file=@/pfad/zum/clip.mp3
-F api_token="$AUDD_API_TOKEN"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The stream-management section enables sending stream URLs and control actions to a third-party API, potentially exposing monitored sources and modifying account state. Because these operations can create recurring cost and persistent monitoring behavior, the external transmission risk is amplified by financial and configuration consequences.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
Für laufende Überwachung von Radios und Live-Streams. **45 $ pro Stream und Monat** (25 $ mit eigenem Katalog), setzt ein im Dashboard gesetztes Stream-Limit voraus. Auf einem Trial ist das nicht enthalten — nenne das, bevor jemand Streams anlegt. Zum kostenlosen Testen verweist AudD auf api@audd.io.

Alle Methoden nehmen `api_token` und liegen unter `https://api.audd.io/`:

| Methode | Parameter | Zweck |
|---|---|---|

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This section describes callback and long-poll mechanisms that transmit recognition events and operational metadata through external services. Exposing callback URLs, longpoll categories, or monitored stream activity can leak behavioral or infrastructure information and expand the attack surface if handled automatically.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md
Callbacks kommen als JSON per POST. Neben Ergebnissen gibt es Benachrichtigungen mit `notification_code`: `0` alles in Ordnung, `650` Stream nicht erreichbar, `651` nur Rauschen, keine Musik. Antwortet der Zielserver nicht mit 200 OK, sammelt AudD die Callbacks und liefert sie später nach.

**Ohne eigenen Server:** Callback-URL auf `https://audd.tech/empty/` setzen — Voraussetzung dafür, dass LongPolling funktioniert. Danach `https://api.audd.io/longpoll/?category=<longpoll_category>&timeout=50&since_time=<ts>` abfragen und den zurückgegebenen `timestamp` als nächstes `since_time` verwenden. Die `longpoll_category` steht in der Antwort von `getStreams/`; sie darf an Clients weitergegeben werden, der `api_token` niemals.

Fertige Anzeige: `https://widget.audd.tech/?ch=-<category>&background&history&shadow` (Minuszeichen vor der Kategorie beachten).