v1.0.2

DJ mp3 sourcer

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:47 AM.

Analysis

The skill mostly matches its music-downloading purpose, but its required filename-normalization script can rename files using unsanitized tracklist data, which may move MP3s outside the intended folder.

GuidanceReview the rename script before using it, especially with automatically parsed tracklists. If you install it, keep downloads in a dedicated folder, avoid untrusted tracklist JSON, and consider modifying the script to sanitize filenames and confirm renames before moving files.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

scripts/normalize-filenames.sh

ARTIST=$(jq -r ".[${i}].artist" "$TRACKLIST")
TITLE=$(jq -r ".[${i}].title" "$TRACKLIST")
TARGET="${ARTIST} - ${TITLE}.mp3"
...
mv "$MATCH" "$DIR/$TARGET"

The script reads artist/title values from a JSON tracklist and uses them directly in an mv destination path. Without stripping '/', '..', or other unsafe path text, malformed or crafted track metadata can move a matched MP3 outside the intended directory or into unintended nested paths.

User impactA bad tracklist entry could cause downloaded files to be moved to unexpected locations instead of staying in the selected download folder.

RecommendationSanitize artist and title to safe basenames before renaming, reject path separators and '..', verify the resolved destination stays inside the chosen directory, and consider a dry-run or confirmation before moving files.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

pip install yt-dlp spotdl
brew install ffmpeg  # needed by yt-dlp for audio extraction

# optional
pip install bandcamp-dl

These third-party tools are central to the stated purpose, but the installation commands are manual and unpinned, and the registry metadata provides no install spec to lock versions or provenance.

User impactUsers may install changing versions of external downloader tools whose behavior or security properties can vary over time.

RecommendationInstall these tools from trusted sources, consider pinning versions, and have the skill metadata declare the required binaries/dependencies.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

When given multiple links, process in parallel using sub-agents (`sessions_spawn`). Report results as each track completes.

The skill explicitly delegates batch work to parallel sub-agents. This is purpose-aligned for batch downloads, but the artifacts do not describe concurrency limits or data boundaries for what each sub-agent receives.

User impactLarge batches may cause multiple parallel agents to act on links and track data at the same time, which can make activity harder to monitor.

RecommendationUse batch mode only for link sets you trust, prefer clear concurrency limits, and keep each sub-agent scoped to only the link or track it needs.