ClawHub
Back to skill

Security audit

Music Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Music Assistant controller, but it needs review because it uses a long-lived bearer token over a user-configured endpoint documented as plaintext HTTP and encourages broad direct API calls.

Install only if you trust the Music Assistant server endpoint and can protect the token. Prefer HTTPS or a trusted local-only connection, use a dedicated low-scope token if Music Assistant supports it, revoke and rotate the token if it may have crossed an untrusted network, and be aware that direct API commands and queue/playback actions can immediately change the active listening session.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/mactl.py:35
Finding

Long-Lived Music Assistant Bearer Token Transmitted Over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tainted flow: 'req' from os.environ.get (line 38, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/mactl.py (reported line 48)May include surrounding context.

python
)

    try:
        with urlopen(req, timeout=10) as resp:
            data = resp.read().decode()
            if not data:
                return None

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Finding your token:

  1. Open Music Assistant web UI
  2. Go to Settings → Security
  3. Create or copy your Long-Lived Access Token

Finding your player ID:

bash

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment variables and performs networked control of a music server, but it does not declare an explicit tool/permission scope. That creates a governance gap: an agent may be allowed to invoke network and environment-backed actions without a clear least-privilege contract, increasing the chance of unintended external actions or secret exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

For operations not covered by the CLI, use the JSON-RPC API directly:

bash
curl -s "http://YOUR_SERVER:8095/api" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $MA_TOKEN" \
  -d '{"message_id":"1","command":"player_queues/all"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The bearer token is sent in an Authorization header to whatever URL is configured in MA_URL, including plain http endpoints shown in the setup example. If used over unencrypted transport, anyone on the network path can intercept the token and gain control over the Music Assistant server and associated media actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The pause command claims to pause playback but actually calls the play/pause toggle endpoint. In an agent context, this can cause the opposite of the requested action and unexpectedly start playback, which is a control-integrity issue because user intent is not reliably enforced.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes playback control, volume, queue management, library search, checking status, and player control. The sync command triggers music/sync, which initiates a backend library synchronization task rather than controlling playback or searching the library, expanding behavior beyond the described user-facing scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file documents actions like clearing the queue and changing playback state, which can alter the user's current listening session, but it does not include any warning that these commands are disruptive or irreversible in the moment. Under the markdown-file criteria, behaviors affecting user data or system state should be disclosed clearly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.