ClawHub
Back to skill

Security audit

Netease Music Pusher

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for NetEase Music recommendations, but it persists reusable login cookies insecurely and asks users to pass phone numbers and SMS codes on the command line.

Review this skill before installing. Use it only in a private workspace, treat secrets/netease_cookies.json as a password-equivalent session file, delete it when no longer needed, and avoid entering real phone numbers or SMS codes directly in shell commands where history or process logs may capture them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/netease_client.py:190
Finding

Authentication cookies are stored without enforced restrictive permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/netease_client.py:278
Finding

Phone numbers and one-time login codes are accepted through process arguments

Content
View full analysis
") print(" python3 netease_client.py login <手机号> <验证码>") print(" python3 netease_client.py daily") return cmd = sys.argv[1] if cmd == 'send_captcha' and len(sys.argv) > 2: phone = sys.argv[2] client.send_captcha(phone) elif cmd == 'login' and len(sys.argv) > 3: phone = sys.argv[2] captcha = sys.argv[3] client.login_with_captcha(phone, captcha) ``` The documentation directs users to invoke login with both values on the command line: ```bash python3 skills/netease-music-pusher/scripts/netease_client.py send_captcha python3 skills/netease-music-pusher/scripts/netease_client.py login ``` ### Technical Analysis The login command obtains the phone number and one-time captcha directly from `sys.argv`. Command-line arguments can be exposed through shell history, process inspection interfaces, terminal-session logging, job schedulers, monitoring agents, crash reports, or command audit logs. Although the captcha is short-lived, it is authentication material during its validity period. The phone number is personal information and remains sensitive after the code expires. Passing these values as command arguments is not necessary for the declared login functionality because they can be collected through protected interactive input or standard input. The README also contains a concrete phone number and sample captcha in its usage examples. ...[truncated 1487 chars]
Remediation
View remediation
` and ``. 7. Warn users that terminal recording and automation logs must not capture authentication input. Example: ```python from getpass import getpass elif cmd == "login": phone = input("Phone number: ").strip() captcha = getpass("Captcha code: ").strip() client.login_with_captcha(phone, captcha) ``` ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Obfuscated Code

High
Category
Supply Chain
Confidence
60% confidence
Finding

Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.

Content

Scanner excerpt · scripts/netease_client.py (reported line 18)May include surrounding context.

python
"""网易云加密工具"""
    
    # 网易云固定密钥
    MODULUS = '00e0b509f6259df8642dbc35662901477df22677ec152b5ff68ace615bb7b725152b3ab17a876aea8a5aa76d2e417629ec4ee341f56135fccf695280104e0312ecbda92557c93870114af6c9d05c4f7f0c3685b7a46bee255932575cce10b424d813cfe4875d3e82047b97ddef52741d546b8e289dc6935b3ece0462db0a22b8e7'
    NONCE = '0CoJUm6Qyw8W8jud'
    PUBKEY = '010001'
    IV = '0102030405060708'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 112)May include surrounding context.

bash
# 添加任务（北京时间每天8:00）
curl -X POST "http://localhost:8000/cron/jobs" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "网易云日推推送",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README states that the skill does not store sensitive information, yet it explicitly documents saving authenticated NetEase cookies to secrets/netease_cookies.json. Session cookies are sensitive credentials because anyone with access to the file may be able to reuse the authenticated session without the user's phone or SMS code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README tells users that login results in cookies being saved on disk, but it does not clearly warn that this creates a persistent authenticated session. Persisting cookies locally increases the risk of account misuse if the host, workspace, backups, or logs are accessible to other users or processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation explicitly states that login cookies are saved to secrets/netease_cookies.json but does not warn users that this creates persistent session material on disk. If that file is exposed through weak filesystem permissions, backups, logs, or workspace sharing, an attacker may be able to reuse the session and access the user's 网易云 account context without needing the SMS code again.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The client persists authenticated session cookies to disk at a fixed path under /root without warning the user that login state will be stored. Those cookies likely represent bearer-style session credentials, so any local process or user with access to that file can reuse the session and access the account without re-authentication.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/netease_public_api.py (reported line 20)May include surrounding context.

python
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/netease_public_api.py (reported line 38)May include surrounding context.

python
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/netease_public_api.py (reported line 52)May include surrounding context.

python
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/netease_public_api.py (reported line 96)May include surrounding context.

python
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/netease_public_api.py (reported line 110)May include surrounding context.

python
'Referer': 'https://music.163.com/'
        })
    
    def get_toplist_detail(self, list_id):
        """获取榜单详情"""
        url = f'https://music.163.com/api/playlist/detail?id={list_id}'
        try:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The cron example specifies 北京时间每天8:00 and Asia/Shanghai, which imposes a specific locale/timezone behavior in the user-facing instructions. The README does not indicate that this is only an example or offer guidance for adapting the schedule to other locales.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The entire skill documentation is presented only in Chinese, with no indication that language selection is optional or that the skill is intentionally restricted to a Chinese-speaking context. The policy requires avoiding forced language or locale constraints unless users are given a choice or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request headers hard-code Accept-Language to zh-CN,zh;q=0.9, which imposes a specific locale on all outbound requests. This is a natural-language policy concern because the file does not offer user opt-in, selection, or explain why a fixed Chinese locale is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.