Spotify

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:31 AM UTC
• Version: 1.0.0

Overview

This Spotify CLI skill appears purpose-aligned, but its installation and troubleshooting instructions ask users to make system-level changes and handle secrets in ways that deserve careful review.

Review before installing. Prefer a virtual environment, pinned dependencies, and no '--break-system-packages'; avoid copying anything into '/usr/local/bin' with sudo unless you know exactly which script is being installed; protect the config file with restrictive permissions; and do not delete '~/.cache-*' broadly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Dependency Installed into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 15
Vulnerability Type: Unpinned third-party dependency and unsafe system package override
Risk Level: Medium

Vulnerable Code:

bash

pip3 install spotipy --break-system-packages

Technical Analysis

The installation command retrieves spotipy without pinning a reviewed version or verifying package hashes. Consequently, the installed content can change over time even though the skill documentation remains unchanged.

The --break-system-packages option bypasses Python's externally managed environment protection. This can introduce dependency conflicts or modify an interpreter environment used by other system applications. Python packages can also execute package build or installation logic during installation.

No evidence indicates that spotipy itself is malicious. The risk arises from mutable dependency resolution, lack of integrity verification, and installation into an insufficiently isolated environment.

Attack Path

1. A user follows the documented installation command.
2. pip queries its configured package index and resolves the current available spotipy release and transitive dependencies.
3. A compromised, malicious, or incompatible future release is downloaded without a version or hash check.
4. Package installation or build logic executes with the privileges of the user running pip.
5. The package may access that user's files and credentials or modify the Python environment available to other applications.

Impact Assessment

Successful supply-chain exploitation could execute code with the installing user's privileges, exposing files, environment variables, and credentials accessible to that account. The command may also destabilize system Python packages. The documented command does not use sudo, so it does not by itself demonstrate root-level execution; system-wide impact depends on the permissions of the Pytho ...[truncated 43 chars]

Remediation

View remediation

Remediation Suggestions

• Create a dedicated virtual environment rather than overriding system package protections.
• Pin spotipy and all transitive dependencies to reviewed versions.
• Use a requirements file with cryptographic hashes and install with --require-hashes.
• Remove --break-system-packages.
• Periodically review pinned dependencies for security updates before changing versions.

Example hardened workflow:

bash

python3 -m venv ~/.local/share/spotify-cli/venv
~/.local/share/spotify-cli/venv/bin/python -m pip install --require-hashes -r requirements.txt

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Spotify Client Secret Stored Without Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-34
Vulnerability Type: Plaintext sensitive configuration with unspecified access controls
Risk Level: Medium

Vulnerable Code:

bash

mkdir -p ~/.config/spotify-cli
cat << EOF > ~/.config/spotify-cli/config
SPOTIPY_CLIENT_ID=your_client_id
SPOTIPY_CLIENT_SECRET=your_client_secret
SPOTIPY_REDIRECT_URI=http://127.0.0.1:8888/callback
EOF

Technical Analysis

The instructions write the Spotify client secret to a plaintext configuration file but do not set restrictive permissions on either the containing directory or the file. The resulting access permissions depend on the user's current umask and preexisting directory permissions.

On a multi-user system or a host running other local services, permissive permissions could allow another local account or process to read the application credential. The loopback redirect URI is expected for this OAuth workflow and is not itself the issue.

Attack Path

1. A user creates the configuration while operating under a permissive umask or using an already permissive configuration directory.
2. The resulting file is readable by another local account or process.
3. That principal reads SPOTIPY_CLIENT_ID and SPOTIPY_CLIENT_SECRET.
4. The credentials are reused to impersonate or abuse the registered Spotify developer application within the limits imposed by Spotify.

Impact Assessment

Exposure is limited to the Spotify application credentials stored in this file. It does not automatically disclose the user's Spotify password or OAuth access token. However, an attacker could misuse the registered application's identity, consume API quota, interfere with application management, or combine the credentials with other OAuth weaknesses. Access is bounded by the permissions and capabilities Spotify grants to the application.

Remediation

View remediation

Remediation Suggestions

• Set a restrictive umask before creating the directory and file.
• Create the directory with mode 700 and the configuration file with mode 600.
• Avoid printing the actual secret in terminal history or logs.
• Prefer an operating-system credential store where available.
• Document credential rotation if unintended disclosure occurs.

Example hardened configuration procedure:

bash

umask 077
install -d -m 700 ~/.config/spotify-cli
cat << EOF > ~/.config/spotify-cli/config
SPOTIPY_CLIENT_ID=your_client_id
SPOTIPY_CLIENT_SECRET=your_client_secret
SPOTIPY_REDIRECT_URI=http://127.0.0.1:8888/callback
EOF
chmod 600 ~/.config/spotify-cli/config

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:120

Finding

Overbroad Wildcard Used in Cache Deletion Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 120-121
Vulnerability Type: Unsafe wildcard-based file deletion guidance
Risk Level: Low

Vulnerable Code:

text

### Auth token expired
Delete `~/.cache-*` files and re-authenticate.

Technical Analysis

The wildcard ~/.cache-* is not scoped to a known Spotipy or Spotify token-cache file. It can match unrelated files in the user's home directory whose names begin with .cache-. If the user translates this guidance into a deletion command, all matching files may be removed.

The documentation does not display the expanded matches, identify the exact token-cache path, create a backup, or request confirmation before deletion.

Attack Path

1. Authentication expires or otherwise fails.
2. The user follows the troubleshooting guidance and runs a command such as rm ~/.cache-*.
3. The shell expands the wildcard to every matching home-directory entry.
4. Files belonging to unrelated applications are deleted alongside any Spotify authentication cache.
5. Applications using those files may lose cached state, authentication state, or recoverable user data.

Impact Assessment

The operation would normally run with the current user's privileges and could delete any matching files owned or writable by that user. It does not inherently provide an attacker with additional privileges. The primary impact is unintended local data loss, application disruption, and forced reauthentication for unrelated software.

Remediation

View remediation

Remediation Suggestions

• Identify and document the exact cache filename created by the implementation.
• Never recommend deleting a broad wildcard pattern.
• Display and verify the target path before deletion.
• Request confirmation and preserve a backup where practical.
• If cache naming is configurable, have the CLI expose a dedicated command that safely clears only its own authentication cache.

Safer guidance should use an exact path, for example:

bash

rm -- "$HOME/.config/spotify-cli/exact-token-cache-name"

The example filename must be replaced with the exact path actually used by the implementation after that implementation has been reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

pip3 install spotipy --break-system-packages

text

### 2. Create a Spotify Developer App

1. Go to https://developer.spotify.com/dashboard
2. Log in and click "Create App"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions tell users to place Spotify Client ID and Client Secret in a plaintext config file under their home directory without any warning about protecting the file or restricting permissions. While this is common in simple CLI setups, exposed OAuth client secrets can be abused by other local users, malware, backups, or accidental disclosure, especially on shared systems.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

4. Install the script

bash

sudo cp spotify /usr/local/bin/spotify
sudo chmod +x /usr/local/bin/spotify

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

4. Install the script

bash

sudo cp spotify /usr/local/bin/spotify
sudo chmod +x /usr/local/bin/spotify

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

### 5. Authenticate

Run any command (e.g., `spotify status`). On first run, you'll get a URL to open in your browser. After authorizing, copy the redirect URL (even if the page doesn't load) and paste it when prompted.

## Commands

Static analysis

No suspicious patterns detected.