ClawHub
Back to skill

Security audit

Monochrome

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only music skill uses disclosed external streaming/search APIs and does not install code, read local data, or request credentials, but users should consider privacy and copyright implications.

Install only if you are comfortable with your agent contacting the listed Monochrome/Hi-Fi API instances for music searches and stream URLs. Prefer the primary instance over community endpoints you do not trust, and use returned streams in compliance with applicable copyright and service terms.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill advertises music discovery and streaming but does not clearly warn users that it can retrieve direct streaming URLs and point them to third-party or community proxy instances. That omission can mislead users about legal, privacy, and trust implications, especially because community-operated endpoints may log requests, serve unauthorized content access paths, or facilitate downloading beyond ordinary playback expectations.

Static analysis

No suspicious patterns detected.