Security audit
Security checks for vulnerabilities and agentic risk
This is a simple local music recommendation skill with some overbroad or stale documentation, but no evidence of hidden network access, credential use, persistence, or destructive behavior.
This skill is reasonable to install for local mood-based music suggestions. Use it with the context you are comfortable sharing for recommendations, and treat the storage, learning, and generated-playlist claims as documentation issues unless the publisher updates the implementation and scope details.
The description says recommendations are based on current mood, activity, or conversation context, but it does not define clear invocation boundaries. In agent ecosystems, vague conversational triggering can cause the skill to activate on unrelated user content, increasing unintended context consumption and expanding the chance of privacy leakage or inappropriate responses.
The phrase 'Your agent reads the vibe and suggests music' is overly broad and implies passive interpretation of general conversation without a precise activation rule. That ambiguity can let the skill process more conversational context than necessary, which is risky in systems where skills may be invoked automatically or share surrounding user messages.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
The DATA DISCLAIMER explicitly states that the software 'processes and stores data locally on your system.' In this file, the documented skill scope is just conversation-based music recommendations, and there is no code or operational detail supporting local storage behavior, making the documentation appear to overstate what the skill does.
No suspicious patterns detected.