Security audit

酷狗

Security checks across malware telemetry and agentic risk

Overview

This Kugou music skill mostly matches its purpose, but it needs Review because it handles account login secrets and can automatically modify installed tools or skill directories.

Review before installing. Use it only if you intend to let an agent access your Kugou account, music history, favorites, and playlist creation. Prefer QR login over pasting a base64 secret; if you use a secret, treat it like a password because it is saved locally and grants account access. Be aware that npm installation/postinstall and documented update behavior may modify local agent skill directories or install newer package code.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger conditions are broad enough to activate this skill for ordinary music-related requests that may not specifically require Kugou. That can cause unintended tool invocation, increasing the chance of unnecessary authentication prompts, external network access, or account-affecting actions in contexts where the user did not clearly request this provider.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The keyword list includes generic phrases like music recommendation concepts that overlap with normal conversation, so the skill may be selected even when the user did not intend to use Kugou. In this skill, mistaken activation is more dangerous because it can lead the agent into credential collection flows and authenticated account operations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs or enables automatic global npm self-update, which modifies the host environment by installing new code without an explicit just-in-time user approval. This creates a supply-chain and change-control risk: a normal skill invocation can result in execution of newly fetched package code with the agent's privileges.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill encourages users to provide a base64 'secret' for login/import without clearly treating it as a sensitive credential. Because this value grants account access, normalizing its collection in chat increases the risk of credential disclosure, accidental logging, reuse across sessions, or social engineering into surrendering account tokens.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation tells the agent/user to import a base64 secret and explicitly states it will be persisted locally, but it never clearly warns that the secret is a sensitive authentication credential equivalent to account access. In this skill context, the agent is encouraged to proactively ask for and handle the secret in environments where QR login is inconvenient, which increases the chance of credential over-collection, unsafe transmission, or storage without informed user consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The documentation states that npm installation will automatically invoke install.js to install SKILL.md into platform skill directories, which implies filesystem modification as a side effect of package installation. Even if limited to user-owned directories, performing writes during install without a prominent warning reduces informed consent and can surprise users or automation pipelines that expect package installation to be non-invasive beyond the package itself.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The documented commands expose sensitive preference and behavioral data such as favorites, recent plays, and listening statistics without any accompanying privacy-use warning or minimization guidance. In an agent setting, this increases the risk that the skill will retrieve and surface personal music history more broadly than the user expects, especially because the data can reveal habits, routines, language preferences, and interests.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.