Security audit

cmus Music Player

Security checks for vulnerabilities and agentic risk

Overview

This cmus playback skill mostly matches its stated purpose, but it includes an unsafe path-handling command that could execute unintended shell commands.

Review this skill before installing. Its intended behavior is a local cmus music controller, but it should be changed to remove `eval echo` and handle file paths with safe quoting or non-evaluating path resolution. Users should also be aware that it can open a GUI terminal and control/clear the active cmus playlist.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:31
Finding: Arbitrary Command Execution Through Unsafe Path Evaluation
Content: View full analysis
` using `eval echo` to ensure absolute pathing before passing to `cmus-remote`. ### Mode A: Play track and shuffle the rest (Default) Trigger Intent: "Play this track", "Open song...", "Play and shuffle". Execute this bash block: TARGET_FILE=$(eval echo "") cmus-remote -C "clear" cmus-remote -C "add $HOME/.openclaw/workspace/music/" cmus-remote -C "set continue=true" cmus-remote -C "set shuffle=true" cmus-remote -f "$TARGET_FILE" ### Mode B: Play ONLY the requested track Trigger Intent: "Play only this track", "Do not shuffle", "Single track mode". Execute this bash block: TARGET_FILE=$(eval echo "") cmus-remote -C "clear" cmus-remote -C "add $TARGET_FILE" cmus-remote -C "set continue=false" cmus-remote -C "set repeat=false" cmus-remote -p ``` ### Technical Analysis The skill explicitly instructs the agent to interpolate a user-influenced file path into shell source and process it with `eval`. Unlike ordinary variable assignment, `eval` reparses its arguments as shell code. Consequently, shell constructs embedded in the supplied path—including command substitutions, backticks, variable expansions, redirections, separators, or other shell syntax—can be interpreted and executed. For example, a path containing a command substitution such as `$(attacker_command)` would cause that command to execute while `TARGET_FILE` is being assigned. The surrounding double quotes do not neutralize this behavior because the purpose of `eval` is to perform another round of shell parsing. The same unsafe pattern appears in both supported playback modes, so changing the requested playback mode does not avoid the vulnerability. ### Attack Path 1. An attacker supplies or influences the media path given to the skill. 2. The c ...[truncated 1107 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill directs the agent to inject DISPLAY, XAUTHORITY, and DBUS_SESSION_BUS_ADDRESS and to launch xfce4-terminal, altering the user's graphical session without any warning or consent flow. In a headless/background context this crosses privilege and session boundaries, and could expose or interfere with another logged-in user's desktop session if the environment assumptions are wrong.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly instructs the agent to resolve a user-controlled file path with eval echo, which performs shell evaluation rather than simple path expansion. If the supplied path contains command substitution or other shell metacharacters, this can lead to arbitrary command execution in the agent's session, far beyond the stated purpose of playing media.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown defines activation phrases like "Play this track," "Open song...," and "Play and shuffle" as trigger intents, but these are common user utterances and do not clearly specify when this skill should or should not activate. The file also provides no negative examples or explicit constraints to prevent overlap with other music or file-opening skills.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.