Tidal CLI

PassAudited by ClawScan on May 4, 2026.

Overview

This is a coherent Tidal command-line skill, but it installs an external npm CLI, stores a Tidal login session locally, and can change or delete Tidal playlists and favorites.

This skill appears purpose-aligned for controlling Tidal from the terminal. Before installing, make sure you trust the external npm package, understand that it stores a reusable Tidal session locally, and ask the agent to confirm before making playlist or library changes.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill means trusting the external npm CLI package to run on the local machine and handle Tidal account actions.

Why it was flagged

The skill depends on an external npm package to provide the tidal-cli binary, while the supplied artifact set contains only SKILL.md and no reviewed package source.

Skill content

package: "@lucaperret/tidal-cli"

Recommendation

Install only if you trust the npm package and publisher; consider reviewing the package source and npm metadata before authenticating.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone or any process able to use that session file may be able to act on the user's Tidal account through the CLI.

Why it was flagged

The skill uses a persistent local Tidal login session, which is expected for Tidal account control but gives the CLI ongoing delegated access to the user's account.

Skill content

Credentials persist at `~/.tidal-cli/session.json` and auto-refresh.

Recommendation

Use this only on trusted devices, protect the session file, and revoke or remove the session if the package or machine is no longer trusted.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If invoked incorrectly, the agent could remove or change playlists or library items in the user's Tidal account.

Why it was flagged

The documented CLI supports mutating and deleting Tidal account data such as playlists, playlist tracks, and library favorites.

Skill content

tidal-cli --json playlist delete --playlist-id <id>
tidal-cli --json playlist remove-track --playlist-id <id> --track-id <track-id>
tidal-cli --json library remove --artist-id <id>

Recommendation

Confirm the target playlist, track, album, or artist before running rename, delete, add, or remove operations, especially destructive ones.