sonos

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:12 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a straightforward Sonos control helper, with a notable but disclosed third-party install supply-chain risk.

Install only if you are comfortable building and running the upstream sonoscli Go package on your machine. For lower risk, prefer a version pinned to a reviewed commit and avoid exposing unrelated credentials in the environment when using the CLI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4

Finding

Unpinned Third-Party Go Dependency Permits Mutable Code Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned executable dependency from an external source
Risk Level: Medium

Vulnerable code:

json

metadata: {"clawdbot":{"emoji":"🔊","requires":{"bins":["sonos"]},"install":[{"id":"go","kind":"go","module":"github.com/steipete/sonoscli/cmd/sonos@latest","bins":["sonos"],"label":"Install sonoscli (go)"}]}}

Technical Analysis

The installation metadata requests github.com/steipete/sonoscli/cmd/sonos@latest. The @latest selector is mutable and resolves whatever upstream version is considered current at installation time. Consequently, the executable source installed for one user may differ from the source reviewed during this audit.

The package does not specify a reviewed semantic version or immutable commit and does not provide an independent checksum, signature, vendored source, or provenance policy. This creates a supply-chain exposure: compromise of the upstream repository, its maintainer account, or its release process could cause modified code to be downloaded, compiled, and installed without any corresponding change to this Skill package.

No evidence establishes that the current upstream dependency is malicious. The vulnerability is the absence of dependency pinning and integrity controls.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the release publication process.
2. The attacker publishes a modified version that is selected by Go as @latest.
3. A user installs this Skill after the malicious version becomes current.
4. The installer downloads and compiles the attacker-controlled Go source into the sonos executable.
5. When the installed executable is invoked, the malicious code runs with the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing or invoki ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, fixed semantic version or, preferably, an immutable commit reference.
2. Review the source code and release provenance of the exact pinned revision before publishing the Skill.
3. Record and verify cryptographic checksums or signed provenance for distributed binaries and source artifacts where the installation mechanism supports them.
4. Consider vendoring the reviewed source or distributing a reproducibly built, signed binary from a trusted release channel.
5. Configure automated dependency monitoring to identify security updates, but require explicit review and a metadata change before advancing the pinned version.
6. Run the installed CLI with least privilege and avoid exposing unrelated credentials or sensitive environment variables to it.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.