Tidal CLI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:16 AM UTC
• Version: 1.2.5

Overview

This Tidal skill is coherent, but it installs an unpinned third-party CLI that stores a persistent session and exposes playlist/library changes without clear safety checks.

Review this before installing if you use Tidal on a shared machine or care about playlist/library changes. Only authenticate if you trust the npm package source, protect ~/.tidal-cli/session.json as sensitive account material, and have the agent confirm exact playlist, track, or library targets before delete, remove, or rename actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party CLI Handles Persistent Tidal Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-13, 21-27
Vulnerability Type: Unpinned third-party dependency with access to persistent account credentials
Risk Level: Medium

Vulnerable Code

yaml

metadata:
  openclaw:
    requires:
      bins: ["tidal-cli"]
    install:
      - id: node
        kind: node
        package: "@lucaperret/tidal-cli"
        bins: ["tidal-cli"]
        label: "Install tidal-cli (npm)"

markdown

If `tidal-cli` is not authenticated, run auth first. This opens the user's browser for Tidal login (one-time):

```bash
tidal-cli auth

Credentials persist at ~/.tidal-cli/session.json and auto-refresh.

text

### Technical Analysis

The installation configuration references `@lucaperret/tidal-cli` without an exact version or integrity hash. Dependency resolution can therefore select a future package release whose contents were not part of this audit. The dependency's implementation, lifecycle scripts, and runtime behavior are absent from the reviewed project and cannot be verified from `SKILL.md`.

The installed CLI is then entrusted with browser-based Tidal authentication and a persistent, automatically refreshed session. It can also perform account-authorized operations, including reading profile information, obtaining playback URLs, and modifying playlists and library favorites. Consequently, compromise of the npm package, its publisher account, or its distribution path could place authenticated account access under attacker-controlled code.

This finding establishes an unsafe supply-chain configuration, not that the currently published package is malicious.

### Attack Path

1. An attacker compromises the npm package publisher, the package distribution process, or a future release of `@lucaperret/tidal-cli`.
2. Because no exact version or integrity value is specified, installation resolves and executes the compromised release.
3. The user or Agent runs `tidal-cli auth`, establishing a renewable Tidal 
...[truncated 906 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @lucaperret/tidal-cli to a specific, reviewed version rather than allowing unconstrained resolution.
2. Use lockfile and registry integrity verification, and preserve the expected package digest in the trusted installation process.
3. Audit the package source, transitive dependencies, and npm lifecycle scripts before deployment.
4. Disable dependency lifecycle scripts where operationally possible, or explicitly allow only reviewed installation behavior.
5. Use a trusted registry and monitor package ownership, release history, and integrity changes.
6. Ensure ~/.tidal-cli/session.json is created with permissions restricting access to the owning user.
7. Prefer scoped, revocable credentials and provide clear session-revocation guidance.
8. Require explicit user confirmation before destructive operations such as playlist deletion or broad library modification.
9. Vendor or otherwise make the reviewed CLI implementation available with the Skill so its effective runtime behavior can be audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises very broad trigger phrases such as general music-related requests, playlist management, playback, and recommendations, which can cause it to activate for common user intents without sufficiently clear scoping to Tidal-specific actions. In an agent environment, overbroad activation increases the chance of unintended tool use, including account-linked operations like modifying playlists or accessing profile data when the user did not explicitly request Tidal interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented commands include destructive actions such as playlist delete, rename, remove-track, and library removal, but provide no guidance to confirm intent, preview targets, or require a safety check before execution. In an autonomous or semi-autonomous agent context, this creates a real risk of accidental data loss or unwanted account changes from ambiguous requests or incorrect ID resolution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill instructs the user to authenticate and notes that credentials persist in ~/.tidal-cli/session.json, but it does not warn about local session sensitivity, file permissions, shared-machine risk, or avoiding disclosure of session artifacts. While this is common CLI behavior, omitting privacy and credential-handling guidance can lead to accidental exposure of reusable session material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.