ClawHub
Back to skill

Security audit

Spotify

Security checks for vulnerabilities and agentic risk

Overview

This Spotify skill is purpose-aligned, but it directs the agent to always run an unbundled local script outside the reviewed package while using Spotify account credentials and account-changing commands.

Review or provide the exact `~/.openclaw/scripts/spotify.py` yourself before using this skill. Install only if you are comfortable giving it Spotify account access, storing Spotify app credentials in macOS Keychain, and letting agent-triggered commands control playback and create or modify playlists. Prefer explicit Spotify requests and confirm account-changing actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:25
Finding

Forced Execution of an Unbundled and Unverified Local Script

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code Snippet:

markdown
> **ALWAYS run `python3 ~/.openclaw/scripts/spotify.py [cmd]`** — never respond with text only.

Technical Analysis

The skill unconditionally instructs the agent to execute ~/.openclaw/scripts/spotify.py and explicitly prohibits a text-only response. The referenced script is outside the project directory and is not included in the audited artifact. Its contents, provenance, permissions, and integrity therefore cannot be verified from this project.

Because the path is mutable and external to the reviewed package, the behavior described by the skill is not necessarily the behavior that will execute. Any process or user capable of creating or replacing that file can control the Python code subsequently run by the agent. The unconditional wording also attempts to direct agent behavior whenever the skill is invoked, without requiring validation of the executable or confirmation from the user.

Attack Path

  1. An attacker or compromised local process creates or replaces ~/.openclaw/scripts/spotify.py.
  2. The replacement script contains attacker-controlled Python code.
  3. The user makes a request matching one of the skill's Spotify-related triggers.
  4. The skill instructs the agent to execute the external script and not provide a text-only response.
  5. The attacker-controlled code runs with the same operating-system privileges and environment access as the agent process.
  6. The script can access resources available to that account, potentially including files, network services, and Spotify credentials retrieved from macOS Keychain.

Impact Assessment

Successful exploitation permits arbitrary Python execution under the privileges of the account running the agent. The resulting scope may include reading or modifying user-access ...[truncated 419 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the Spotify implementation within the audited project rather than referencing a mutable file in the user's home directory.
  2. Resolve the executable through a package-relative canonical path and reject paths that escape the installed skill directory.
  3. Verify the script against a signed release or an approved cryptographic hash before execution.
  4. Remove the unconditional ALWAYS and never respond with text only directives.
  5. Require explicit user confirmation before executing a script whose provenance or integrity cannot be established.
  6. Execute the implementation with least privilege and restrict filesystem, Keychain, subprocess, and network access to what Spotify control strictly requires.
  7. Document the exact credential access and outbound network behavior so they can be audited.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–21
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml
"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "package": "spotipy",
      "label": "Install spotipy (pip)",
    },
  ],

Technical Analysis

The installation metadata requests spotipy without an exact version, lockfile, or cryptographic integrity hash. Dependency resolution can therefore select a different package release over time, making the installed code non-reproducible and allowing its behavior to change after the skill has been reviewed.

No evidence establishes that the named package is currently malicious. The vulnerability is the absence of controls that bind installation to a reviewed artifact. If the upstream package, package index, release process, or dependency chain is compromised, an affected release could execute code during installation or when imported by the Spotify implementation.

Attack Path

  1. An attacker compromises an upstream release, distribution account, package-index path, or transitive dependency associated with the unpinned package.
  2. A malicious or otherwise unsafe package version becomes the version selected by pip.
  3. The skill installation process resolves spotipy without enforcing a reviewed version or hash.
  4. The compromised package is installed.
  5. Malicious code executes during installation or when the package is imported and used.

Impact Assessment

Exploitation can result in code execution with the privileges of the user or process performing installation or running the skill. This may expose user-accessible files, environment data, network access, and credentials available to the process.

The precise impact depends on the installation environment and the behavior of the compromised package. The audited file does not request elevated install ...[truncated 100 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin spotipy to an exact, reviewed version.
  2. Use a lockfile that records all transitive dependencies and their exact versions.
  3. Require cryptographic hashes for every downloaded distribution, such as through a hash-locked requirements file and pip --require-hashes.
  4. Prefer a controlled or explicitly trusted package index and disable unexpected fallback indexes.
  5. Review package provenance, release signatures where available, maintainership changes, and known vulnerabilities before updating the lockfile.
  6. Install dependencies into an isolated virtual environment with least privilege.
  7. Perform dependency updates through a controlled review and testing process rather than automatically accepting the latest release.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The metadata description advertises very broad trigger phrases such as 'pause', 'playlist', 'genres', and 'open spotify', which are likely to collide with ordinary conversation and unrelated user requests. In an agent environment, broad activation can cause unintended execution of playback or account-modifying commands, especially because the skill also instructs the agent to always run a command rather than respond conversationally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction says to ALWAYS run a specific English command invocation and never respond with text only, while elsewhere the skill claims multi-language triggers. This creates a language/locale constraint without user choice or clear opt-in, which may violate organizational language policy expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
## Setup (first time)

1. Create app at [developer.spotify.com/dashboard](https://developer.spotify.com/dashboard)
   — Add redirect URI: `http://127.0.0.1:8888/callback`

2. Add to macOS Keychain:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
# Top tracks of any artist
python3 ~/.openclaw/scripts/spotify.py artist-top-tracks "Massive Attack" 5

# Create playlist from top tracks (one command: creates + fills)
python3 ~/.openclaw/scripts/spotify.py make-playlist "Top March 2026" short 20

# Manage playlists

Static analysis

No suspicious patterns detected.