Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned, but it recommends unsafe installation and includes sensitive authentication flows that users should review before installing.
Review this skill before installing. Prefer an isolated, exact-version CLI install through uv tool or pipx instead of curl-to-bash, perform browser login yourself, avoid pasting passwords or full tokens into agent chats or logs, and confirm the Sun API host and Spotify publishing target before allowing uploads or token creation.
SKILL.md:33Mutable Remote Installer Is Executed Directly Through Bash
SKILL.md:139User-Controlled Prompt Is Demonstrated Through Shell String Interpolation
http-api.md:5Dynamic Authentication Discovery Can Redirect User Credentials
cli-usage.md:19CLI Installation Allows Unreviewed Future Dependency Releases
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
Sun → Spotify upload progress (5/10):
[x] 001 — From Manya to Governess: Early Years and Formative Struggles
[x] 002 — Paris and the Pursuit of Science
[x] 003 — Discovering Radioactivity
[x] 004 — Polonium and Radium: The Discovery of New Elements
[x] 005 — Nobel Prizes and International Recognition
[ ] 006 — generating…
[ ] 007 — generating…
[ ] 008 — generating…
[ ] 009 — generating…
The documented install flow fetches and executes an external script from a remote URL. This is a classic supply-chain and arbitrary-code-execution risk, especially dangerous in a skill because users or agents may follow the command verbatim without reviewing the script contents.
The sun CLI is independently installable — no monorepo checkout required. Four options, in order of recommendation for external users:
# 1. curl installer (simplest — picks uv/pipx/pip automatically)
curl -fsSL https://sunapp-ai.github.io/sun-to-spotify/install.sh | bash
# 2. uv tool (manual, fastest)
Piping remote content directly into bash creates an immediate command-execution chain with no inspection or integrity verification step. In agent-assisted contexts, this is particularly risky because it can transform documentation into an unsafe one-shot execution path that compromises the host environment.
# 1. curl installer (simplest — picks uv/pipx/pip automatically)
curl -fsSL https://sunapp-ai.github.io/sun-to-spotify/install.sh | bash
# 2. uv tool (manual, fastest)
uv tool install 'sun-cli>=0.2.1'
The skill instructs users to carry ~/.config/sun/credentials.json or a minted SUN_TOKEN into headless/CI environments and to surface token secrets to the user. This normalizes manual credential movement and display of high-value secrets, increasing the chance of credential leakage through chat logs, shell history, CI logs, copied files, or insecure transfer channels.
- If `sun --help` fails, the CLI isn't installed. Show the user the Install section above and ask them to confirm before running the installer. If install isn't possible, fall back to the HTTP flow in [references/http-api.md](references/http-api.md).
- If `whoami` reports unauthenticated: do **not** run `sun login` from the agent. `sun login` opens a browser for the loopback POST handoff — this won't complete in an agent context, and there is no `--email`/`--password` fallback. Ask the user to run `sun login` themselves in their terminal and re-invoke the skill. If the user is signing up for the first time, remind them to click the confirmation email link on the same machine where `sun login` is still running — the original loopback completes automatically post-confirmation, no second `sun login` needed. The same applies to the password-reset flow. For CI / fully non-interactive contexts, the user must first run `sun login` interactively on a machine with a browser, then carry the resulting `~/.config/sun/credentials.json` (or a minted `SUN_TOKEN`) over to the headless environment.
- If `whoami` reports authenticated but no active token, run `sun tokens create <name>` (`<name>` matches `^[a-z0-9-]+$`, 1-64 chars). The full secret prints to stdout once and is stored as the active token; surface it to the user but never log it elsewhere.
### 1. Create the audio job
This explicitly recommends fetching and executing a remote script in one step via curl ... | bash, which removes any opportunity for inspection and makes compromise of the distribution channel immediately code-executing on user systems. In a skill whose purpose is to install and operate a CLI with authentication and token handling, this expands the blast radius to credential theft and full workstation compromise.
The sun CLI is self-contained — it ships and works independently of the monorepo. PyPI package name is sun-cli; the installed binary is sun. Once installed, sun is available on PATH from any directory.
curl -fsSL https://sunapp-ai.github.io/sun-to-spotify/install.sh | bash
The | bash construct is a classic unsafe command chain because it directly feeds network-retrieved content into a shell interpreter. This turns any compromise of the remote script source, DNS, TLS termination, or publishing process into immediate arbitrary command execution with the user's privileges.
curl -fsSL https://sunapp-ai.github.io/sun-to-spotify/install.sh | bash
The installer picks the first available Python package manager — uv (preferred), then pipx, then pip --user — and installs sun-cli from PyPI. If none of those is on PATH, the script prints install instructions and exits 1; install one and re-run.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
| Endpoint family | Auth | Header |
| --- | --- | --- |
| Token management (`POST/GET/DELETE /v1/public/tokens*`) | Supabase JWT | `Authorization: Bearer <jwt>` |
| Everything else (`/v1/public/courses*`, `/v1/public/whoami`) | Personal API token | `Authorization: Bearer sk_live_...` |
Token-management endpoints reject API-token auth on purpose: a leaked API token cannot mint replacements.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The browser flow is the only supported way to log in. There is no `--email`/`--password` or `--no-browser` fallback; headless and CI environments need to authenticate on a machine with a browser first, then carry the resulting credentials file or `SUN_TOKEN` over.
The CLI fetches the Supabase URL and anon key automatically from the public `auth-config` endpoint. The refresh token is persisted at `~/.config/sun/credentials.json` with mode `0600` on Unix.
> Verify the exact env-var names with `sun --help`. The CLI is the source of truth — older docs may use different names.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
The browser flow is the only supported way to log in. There is no `--email`/`--password` or `--no-browser` fallback; headless and CI environments need to authenticate on a machine with a browser first, then carry the resulting credentials file or `SUN_TOKEN` over.
The CLI fetches the Supabase URL and anon key automatically from the public `auth-config` endpoint. The refresh token is persisted at `~/.config/sun/credentials.json` with mode `0600` on Unix.
> Verify the exact env-var names with `sun --help`. The CLI is the source of truth — older docs may use different names.
The skill recommends executing a remote installer via curl ... | bash, which streams unaudited code directly into a shell. In an agent or automated workflow, this increases supply-chain risk because a compromised hosting endpoint, repository, or network path could lead to arbitrary code execution on the user's machine.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Save incrementally
Write the `job_id` to disk (or echo it back to the user) immediately after the `202` response. If polling crashes mid-loop, the job keeps generating server-side — re-poll with the same `job_id` rather than restarting.
### Stream — don't wait for the full course
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
test "$TOTAL" -eq "${#UPLOADED[@]}" || echo "WARNING: count mismatch — re-run the loop to pick up missing episodes." >&2
If counts disagree, re-run the streaming loop once. The CLI's `--partial` fetch re-signs URLs and fills in any episode whose `audio_url` was transiently null on the previous pass. If they still disagree, surface the gap to the user — don't loop indefinitely.
---
The documentation recommends a curl-to-shell installer without any integrity verification, signature checking, pinning, or warning about the trust boundary. If the hosting origin, network path, or publication pipeline is compromised, users may execute arbitrary shell commands immediately on their machine.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sun --version # prints "sun-cli "
macOS and Linux are first-class. Windows works for the HTTP calls but the credentials file relies on user-directory ACL, not `chmod 0600`.
### Monorepo dev install (internal contributors only)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
sun whoami # prints email, user_id, active token name
`sun login` opens the user's browser to `https://sunapp.ai/login`, where they can sign in with email + password, create a new account, or reset a forgotten password via the **"Forgot your password?"** link. The webapp posts the resulting Supabase session to a loopback listener the CLI binds; tokens never appear in any URL.
For new accounts, the user signs up with email + password, then clicks the confirmation link Supabase emails them. The link must be opened on the same machine where `sun login` is still running — the original loopback completes the handoff automatically and the CLI logs in. No second `sun login` invocation is needed. The same applies to the password-reset flow: clicking the reset link on the same machine and setting a new password completes the loopback automatically.
The documentation shows a direct email/password grant flow and places credentials inline in a shell example without an explicit warning about secure handling. In an agent skill context, this can encourage implementations that collect, embed, log, or echo user passwords and exchange them with third-party services, increasing the chance of credential exposure.
This example transmits user credentials to an external authentication endpoint using a password grant. Although authentication requires network transmission by design, the risky part is that the skill documentation normalizes direct handling of raw credentials by the client/agent, which is especially dangerous for automated agents that may retain prompts, command history, or logs.
Exchange email + password for a JWT via Supabase's password grant:
JWT=$(curl -sX POST "$SUPABASE_URL/auth/v1/token?grant_type=password" \
-H "apikey: $SUPABASE_ANON_KEY" \
-H "Content-Type: application/json" \
-d '{"email":"alice@example.com","password":"..."}' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sX POST "$BASE/v1/public/tokens" \
-H "Authorization: Bearer $JWT" \
-H "Content-Type: application/json" \
-d '{"name":"laptop"}'