DJ set ripper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:08 PM UTC
• Version: 1.0.1

Overview

This skill mostly does what it says, but it lets untrusted music-page text drive automated downloads and filename changes without enough validation or containment.

Review before installing. Use this only for music you are authorized to download, and prefer trusted tracklist sources or pasted tracklists. Avoid running it with elevated privileges or in shared /tmp environments. Inspect extracted tracklists before downloads and renames, and harden filename and temporary-file handling before relying on it for unattended batches.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:40
• Finding: Indirect prompt injection through untrusted page content## Vulnerability Details **File Location**: `SKILL.md:40-59` **Vulnerability Type**: Indirect prompt injection **Risk Level**: High ### Vulnerable Code ```text Feed the raw page content to the model with this prompt structure: ``` Extract all tracks from this DJ set description. Return a JSON array of objects: [{"number": 1, "timestamp": "0:00", "artist": "Artist Name", "title": "Track Title (Mix Name)"}] Rules: - Preserve remix/mix names in the title (e.g. "Original Mix", "Extended Mix", "Remix") - If a track is listed as "ID - ID" or "ID", set artist and title both to "ID" - If only a timestamp exists with no track info, skip it - Normalize artist names (fix ALL CAPS, etc.) - If no timestamps exist, set timestamp to null - Number tracks sequentially starting from 1 Raw content: """ {description_text} """ ``` ``` ### Technical Analysis Raw text obtained from a user-selected YouTube, SoundCloud, Mixcloud, or 1001Tracklists page is inserted directly into an LLM prompt. The triple-quote delimiters do not create a security boundary, and the workflow does not explicitly require the model to treat instructions embedded in the fetched content as untrusted data. An attacker controlling a page description or other extracted metadata can include instructions that attempt to override the extraction rules, return maliciously crafted metadata, alter the expected output, or induce unintended agent behavior. The resulting tracklist is subsequently trusted as the source of truth for download and filename operations, increasing the impact of successful injection. ### Attack Path 1. An attacker publishes a DJ-set page containing a plausible tracklist followed by adversarial instructions in its description or metadata. 2. A user submits the attacker-controlled URL to the Skill. 3. The Skill retrieves the page content using `yt-dlp` or `web_fetch`. 4. The complete untrusted content is interpolated into the LLM p ...[truncated 721 chars]
• Remediation: ## Remediation Suggestions - Treat all fetched descriptions, comments, metadata, and page text as untrusted data. - Add an explicit instruction that content inside the data block must never be followed as instructions. - Isolate extraction in a restricted model invocation without general-purpose tools or delegated-agent capabilities. - Prefer deterministic parsers for structured sources such as 1001Tracklists. - Validate the response against a strict JSON schema and reject additional fields, malformed types, excessive lengths, control characters, and path separators. - Apply independent allowlist validation to artist and title fields before using them in filesystem operations. - Require confirmation before any extracted value can change the workflow or cause actions beyond ordinary track lookup.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/normalize-filenames.sh:34
• Finding: Unvalidated track metadata is used to construct rename destinations## Vulnerability Details **File Location**: `scripts/normalize-filenames.sh:34-68` **Vulnerability Type**: Unsafe path construction and potential file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash ARTIST=$(jq -r ".[$i].artist" "$TRACKLIST") TITLE=$(jq -r ".[$i].title" "$TRACKLIST") # Skip ID tracks if [[ "$ARTIST" == "ID" && "$TITLE" == "ID" ]]; then continue fi TARGET="${ARTIST} - ${TITLE}.mp3" # If target already exists, skip if [[ -f "$DIR/$TARGET" ]]; then ((SKIPPED++)) continue fi ``` ```bash if [[ -n "$MATCH" ]]; then mv "$MATCH" "$DIR/$TARGET" echo "✅ $(basename "$MATCH") → $TARGET" ((RENAMED++)) fi ``` ### Technical Analysis The script reads `artist` and `title` directly from the supplied JSON file and concatenates them into a destination path. It does not reject `/`, `..`, control characters, absolute-path syntax, or other unsafe filename components. Shell quoting prevents ordinary word splitting and shell metacharacter expansion, but it does not make a filesystem path safe. Slash characters remain path separators, and `..` components are resolved by the filesystem. The fuzzy-match conditions make some straightforward traversal strings difficult to exploit, but they are not a security control. Crafted metadata combined with a matching source filename or a prepared directory/symlink layout can still cause the rename destination to resolve unexpectedly. The `mv` operation also lacks an explicit no-clobber option. If the resolved destination exists but is not detected by the preceding regular-file test—for example, because of races or unusual filesystem objects—the operation may replace it under the current user's permissions. ### Attack Path 1. An attacker influences the page metadata, model-generated tracklist, or `tracklist.json` supplied to the script. 2. The attacker supplies artist or title content containing path separators, traversal compo ...[truncated 888 chars]
• Remediation: ## Remediation Suggestions - Validate that `artist` and `title` are strings and impose conservative maximum lengths. - Reject `/`, backslashes, NUL-equivalent input, newlines, carriage returns, and other control characters. - Reject `.` and `..` path components and sanitize platform-specific reserved filenames. - Convert metadata to safe basenames through a dedicated filename-sanitization function. - Canonicalize the intended destination and verify that its parent remains beneath the canonical output directory. - Refuse destinations involving symlinked path components where practical. - Use `mv --no-clobber -- "$MATCH" "$destination"` or an atomic equivalent after validating the destination. - Add `--` before path operands to prevent filenames beginning with a hyphen from being interpreted as options. - Run normalization with the minimum necessary filesystem privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:78
• Finding: Predictable shared temporary file permits symlink clobbering and cross-run interference## Vulnerability Details **File Location**: `SKILL.md:78-84` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```bash # 1. Write the parsed tracklist as JSON cat > /tmp/tracklist.json << 'EOF' [{"artist": "Artist", "title": "Title"}, ...] EOF # 2. Run normalize scripts/normalize-filenames.sh ~/Downloads/{set-name} /tmp/tracklist.json ``` ### Technical Analysis The documented workflow writes sensitive workflow state to the fixed path `/tmp/tracklist.json`. Shared temporary directories are generally writable by other local users, and shell output redirection follows symbolic links. No exclusive creation, ownership verification, restrictive private directory, or random filename is used. A local attacker can create `/tmp/tracklist.json` as a symbolic link before the workflow runs. The shell may then truncate and replace the linked target if the executing account has permission to write it. Separate concurrent Skill runs also use the same path, allowing one run to overwrite or consume another run's tracklist. ### Attack Path 1. A local attacker predicts the documented `/tmp/tracklist.json` path. 2. Before the Skill reaches this step, the attacker creates that path as a symbolic link to a file writable by the Skill's account. 3. The Skill executes the documented `cat > /tmp/tracklist.json` redirection. 4. The shell follows the symbolic link and truncates or replaces the linked file. 5. Alternatively, a concurrent process replaces the temporary tracklist between creation and consumption, causing attacker-controlled metadata to reach the normalization script. ### Impact Assessment A local attacker may cause the executing account to overwrite any file that account can write or may inject a different tracklist into the normalization stage. Impact is constrained to the current account's filesystem permissions, but it can become more severe if the workflow is execu ...[truncated 120 chars]
• Remediation: ## Remediation Suggestions - Create a private temporary directory with `mktemp -d`, then place the JSON file inside it. - Set a restrictive `umask`, such as `umask 077`, before creating temporary data. - Register a trap to remove the private directory on normal exit and interruption. - Do not use a predictable filename directly under `/tmp`. - Open temporary files with exclusive-creation semantics and verify ownership and file type before use. - Keep the file descriptor open where possible to reduce time-of-check/time-of-use races. - A hardened workflow can use: ```bash umask 077 tmpdir=$(mktemp -d) trap 'rm -rf -- "$tmpdir"' EXIT tracklist="$tmpdir/tracklist.json" cat > "$tracklist" <<'EOF' [{"artist":"Artist","title":"Title"}] EOF scripts/normalize-filenames.sh "$output_dir" "$tracklist" ```

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description centers on end-to-end DJ mix processing: ingesting a mix link or tracklist, extracting metadata, sourcing/downloading each individual track, optionally downloading the full mix, and producing a detailed status log. The actual code does none of those things. It only validates a directory and JSON tracklist input, iterates through track entries, fuzzy-matches existing .mp3 filenames, and renames matched files into a clean naming format. This is a materially different primary purpose and omits the core advertised behaviors, so the description does not accurately represent the code chunk.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill description is broad enough to trigger on ordinary music-download requests and routes users toward sourcing copyrighted tracks from multiple platforms. In context, this increases the chance of unauthorized downloading or policy circumvention, especially because the workflow explicitly automates extraction, lookup, batch downloading, and optional full-mix download at scale.

Static analysis

No suspicious patterns detected.