Use Soulseek to Chat and Share Files

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:05 AM UTC
• Version: 1.0.2

Overview

The skill is coherent for using Soulseek, but it gives under-scoped guidance for peer-to-peer downloads, file sharing, global package installation, and plaintext account credentials.

Review this skill before installing. Use it only with a dedicated Soulseek account and password, avoid sharing broad or personal directories, do not open or execute downloaded files unless independently verified, and prefer isolated or pinned CLI installation over a global npm install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 69–77
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

This is focused on linux. Ensure you have node installed.
Follow the installation instructions, e.g.

sudo apt install -y libsecret-1-dev npm install -g soulseek-cli

text

Technical Analysis

The Skill instructs users to install soulseek-cli globally from the npm registry without specifying a reviewed version, lockfile, integrity hash, or provenance-verification procedure. Consequently, the effective dependency contents may change after this Skill has been audited.

npm packages can define lifecycle scripts that execute during installation. If the upstream package, maintainer account, or distribution channel is compromised, following this instruction could execute attacker-controlled code with the privileges of the account invoking npm. Global installation also exposes the host-wide npm prefix and installs or replaces a command available outside an isolated project environment.

The adjacent sudo apt install command independently requests administrative privileges. Although the shown npm command does not use sudo, users may execute the installation from a privileged shell or change it to use sudo when their global npm prefix is not writable, increasing the potential impact.

Attack Path

1. An attacker compromises the upstream npm package, a maintainer account, or its release process.
2. The attacker publishes a malicious version of soulseek-cli, potentially containing an npm lifecycle script.
3. A user follows the unpinned npm install -g soulseek-cli instruction.
4. npm resolves the mutable package reference to the compromised release.
5. Malicious lifecycle code executes under the invoking account and can access that account's files, network connectivity, environment, and writable npm insta ...[truncated 771 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin soulseek-cli to an explicitly reviewed version rather than resolving the latest release:

   sh

   npm install --save-exact soulseek-cli@<reviewed-version>
   

2. Prefer a project-local installation with a committed lockfile over npm install -g.
3. Verify npm provenance, publisher identity, package integrity, repository ownership, and release artifacts before installation.
4. Review package contents and lifecycle scripts. Where compatible, initially install with lifecycle scripts disabled:

   sh

   npm install --ignore-scripts --save-exact soulseek-cli@<reviewed-version>
   

5. Run the client in a restricted container, virtual machine, or dedicated unprivileged account with minimal filesystem and network access.
6. Do not run npm as root or add sudo to the npm command. Configure a user-owned local npm prefix if necessary.
7. Document a trusted version, expected integrity value, update-review process, and rollback procedure directly in the Skill.
8. Verify downloaded Soulseek installers using publisher signatures or trusted checksums before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill encourages searching for and downloading files from a peer-to-peer network without clearly warning that files from untrusted peers may be malware, trojanized installers, illegal content, or otherwise unsafe. In this context, the omission is significant because the skill is explicitly about interacting with unknown users and downloading arbitrary files, which increases exposure to malicious payloads and unsafe content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

Follow the installation instructions, e.g.

text

sudo apt install -y libsecret-1-dev
npm install -g soulseek-cli

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to place account credentials in environment variables without warning that those secrets can be exposed through shell history, process listings, logs, shared sessions, or inherited environments. Because this is a chat/file-sharing account that may be reused elsewhere, credential disclosure could enable account takeover or broader compromise if passwords are reused.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.