Security audit

Roon Controller

Security checks for vulnerabilities and agentic risk

Overview

This Roon controller skill is coherent and purpose-aligned, with clear caveats around local token storage and an unpinned dependency.

Before installing, understand that this skill can control your Roon playback and will save a Roon authorization token locally at `~/clawd/roon_config.json`. Use it only on a trusted machine, keep that file private, revoke the Roon extension authorization if you stop using it, and consider pinning `roonapi` in a virtual environment before installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: roon_controller.py:91
Finding: Roon Authorization Token Stored Without Enforced Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:2
Finding: Unpinned Third-Party Dependency Permits Unreviewed Future Releases
Content: View full analysis
=0.1.6 ``` `SKILL.md` installation instruction: ```bash pip install roonapi ``` ### Technical Analysis The requirement `roonapi>=0.1.6` allows the package resolver to install any later release. The documentation also instructs users to install the package without specifying a version, package index, lockfile, or cryptographic hash. This makes installation results dependent on mutable upstream package state. A compromised maintainer account, compromised package repository, or malicious future release could cause attacker-controlled installation or runtime code to be installed without any project change. Python packages can execute code during installation and subsequently execute with the application's privileges when imported. No evidence establishes that the current `roonapi` package is malicious. The vulnerability is the absence of version and artifact integrity controls, and exploitation therefore depends on an upstream compromise or malicious future release. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, or its distribution channel and publishes a malicious version satisfying `>=0.1.6`. 2. A user follows the documented installation command or installs from `requirements.txt`. 3. The resolver selects the malicious newer version because no exact version or hash is required. 4. Attacker-controlled package code executes during installation or when this statement runs: ```python from roonapi import RoonApi, RoonDiscovery ``` 5. The malicious dependency operates with the privileges and filesystem/network access of the account running pip or the controller. ### Impact Assessment ...[truncated 409 chars]
Remediation: View remediation
``` 2. Generate a lockfile containing all transitive dependencies and require cryptographic hashes, for example by using `pip-compile --generate-hashes`. 3. Install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Update `SKILL.md` so its installation instructions use the reviewed requirements or lockfile rather than an unconstrained `pip install roonapi`. 5. Document the approved package index and prevent fallback to untrusted or internal indexes that could introduce dependency-confusion risk. 6. Perform dependency updates through a controlled review process that includes provenance checks, vulnerability scanning, and regression testing. 7. Install dependencies in an isolated virtual environment and avoid running pip with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation describes behavior that reads from and writes to the local filesystem by persisting a token in ~/clawd/roon_config.json, but it does not declare any tool scope or permissions boundary. Undeclared file access reduces transparency and reviewability, and in an agent setting can enable unexpected persistence of credentials or modification of local state without explicit user awareness.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill persists the Roon authorization token, host, port, and core ID in a JSON file under the user's home directory without any evident permission hardening, encryption, or disclosure. A local attacker or another process running as the same user could read the token and reuse it to control the user's Roon Core, making this a real credential-handling weakness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Writing an authorization token to a local config file without user-facing disclosure or secure storage increases the risk of credential theft and silent persistence. In this skill's context, the token grants ongoing control over playback infrastructure, so compromise enables unauthorized remote control and potentially reveals device topology such as saved host/core details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The description and heading text emphasize Chinese command support as a built-in language behavior, but do not indicate that language selection is optional or user-configurable. Under the policy rule, forcing or presuming a specific language without explicit opt-in can be a locale/language policy issue.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The dependency is specified with a lower-bound only (roonapi>=0.1.6), which allows installation of any newer version, including future releases that may introduce breaking changes, vulnerable transitive dependencies, or malicious compromise in the supply chain. In an agent skill that directly controls a local media system and performs network discovery, dependency drift increases the risk of unexpected behavior or exposure through upstream package changes.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
# Roon Control Skill Dependencies roonapi>=0.1.6

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest describes controlling playback, querying the current track, auto-discovery, and zone filtering, but does not mention changing or persisting a selected zone. The code adds a separate capability to switch zones and save that preference to disk, which exceeds the described behavior even though it is related to Roon control.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.