T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ymctl.py:173- Finding
OAuth Token Forwarded to an Unvalidated Redirect Host
- Content
View full analysis
- Remediation
View remediation
Security audit
Yandex Music
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended for Yandex Music use, but it should be reviewed because it stores and forwards a reusable account token with avoidable safety issues.
Install only if you are comfortable giving this helper a reusable Yandex Music token and letting it modify liked tracks. Prefer a temporary environment token over saved config, avoid passing tokens directly on the command line, and review or fix the redirect-host validation and dependency pinning before routine use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ymctl.py:358- Finding
OAuth Tokens Exposed Through Command-Line Arguments
- Content
View full analysis
./.venv/bin/python scripts/ymctl.py auth-set --device '' ``` Command-line arguments can be recorded in shell history, terminal logging, orchestration logs, audit systems, crash reports, and process-monitoring tools. On systems where process arguments are visible to other local users, the token may also be captured while the command is running. Several network commands also accept `--token`, creating the same exposure pattern. Although environment variables can also leak under some threat models, interactively entering the secret through a non-echoing prompt or protected file descriptor avoids placing it directly in shell history and the process argument vector. The documented `--device` option is not implemented by the audited parser, although this inconsistency is not itself a security vulnerability. ### Attack Path 1. A user follows the documentation and runs `ymctl.py auth-set ` or supplies `--token `. 2. The shell records the command, or a local process-monitoring or logging facility captures the process argument vector. 3. An attacker with access to the user's history, logs, diagnostics, or process metadata retrieves the plaintext token. 4. The attacker reuses the bearer token to authenticate to Yandex Music. ### Impact Assessment An attacker who obtains the token can exercise t ...[truncated 419 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:26- Finding
Unpinned Third-Party Package Installation Creates Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/ymctl.py:11- Finding
Incorrect Default Path Causes Unnecessary Root-Level Filesystem Mutation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill exposes shell, network, environment, and file read/write capabilities but does not declare any explicit tool scope or permission boundaries. That omission increases the chance an agent can invoke broader-than-necessary operations, including token persistence and package installation, without clear governance or least-privilege constraints.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is presented as inspection/search oriented, but it documents state-changing actions such as like/unlike and auth-set/auth-clear. This mismatch can mislead an agent or user into authorizing the skill under a lower-risk assumption, while it actually supports account modification and credential persistence.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The behavior rules explicitly claim the skill is read/search oriented, yet the documented commands include write operations like like/unlike and auth-set/auth-clear. This internal contradiction weakens operator trust and can cause unsafe automation decisions, especially where read-only skills are granted more permissive default handling.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file’s natural-language request mapping only provides Russian trigger examples for invoking commands. This can amount to a language/locale policy violation because it implies a specific language expectation without stating that other languages are supported or that Russian is optional.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata describes inspection and search capabilities, but the implementation also exposes state-changing operations that like and unlike tracks on the user's Yandex Music account. This mismatch can mislead users or calling agents into granting a token for read-oriented use while unintentionally enabling account modification, creating an authorization and consent boundary violation.
- Content
Static analysis
No suspicious patterns detected.