Music Research (Crate)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:22 AM UTC
• Version: 0.2.3

Overview

The skill’s music research purpose is coherent, but it should be reviewed because it runs an unpinned external MCP package with an API key and includes public publishing and persistent storage with limited controls.

Install only if you are comfortable running the current npm `crate-cli` package with your API key. Prefer pinning and reviewing a specific package version, using restricted or disposable API keys with limits, and confirming any Telegraph or Tumblr publication before content is posted. Check where the tool stores SQLite data and how to delete collection, playlist, cache, or memory records before using persistent features.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Package Is Automatically Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 14-26 **Vulnerability Type**: Unpinned dependency execution through `npx` **Risk Level**: High ```json { "mcpServers": { "crate": { "command": "npx", "args": ["-y", "crate-cli", "--mcp-server"], "env": { "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}" } } } } ``` ### Technical Analysis The MCP configuration invokes `npx` with the package name `crate-cli` but does not specify an exact package version or integrity hash. The `-y` option automatically approves package installation and execution without interactive confirmation. Consequently, the code executed when the MCP server starts is determined by the package registry at installation time rather than by the reviewed skill artifact. A malicious package update, compromised maintainer account, or registry compromise could cause arbitrary attacker-controlled JavaScript to execute locally. The package process runs with the permissions of the user who launches the agent and also receives the configured environment variables. ### Attack Path 1. An attacker compromises the `crate-cli` package, its publisher account, or its package publication pipeline. 2. The attacker publishes a malicious version under the same package name. 3. A user installs or loads the skill and starts the configured MCP server. 4. `npx -y crate-cli --mcp-server` resolves and downloads the current package version without requiring approval. 5. Package installation hooks or runtime code execute with the agent user's operating-system permissions. 6. The malicious process can access files, network resources, inherited credentials, and other resources available to that user. ### Impact Assessment Successful exploitation can result in arbitrary code execution under the account running the agent. The accessible scope may include user-readable files, writable project data, network-accessible ...[truncated 249 chars]
• Remediation: ## Remediation Suggestions - Pin `crate-cli` to a specific, reviewed version, such as `crate-cli@0.2.3`, rather than resolving the latest release. - Install the dependency through a committed lockfile and enforce package integrity verification. - Prefer a preinstalled executable from a trusted, reproducible build instead of downloading code automatically when the MCP server starts. - Remove `-y` so unexpected installation or resolution behavior does not proceed silently. - Review package installation scripts, transitive dependencies, provenance attestations, and publisher history before deployment. - Run the MCP server in a sandbox or container with restricted filesystem access, network egress, and operating-system permissions. - Monitor and explicitly approve dependency updates rather than accepting mutable upstream behavior automatically.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20
• Finding: Sensitive API Credential Is Passed to an Unpinned Third-Party Process## Vulnerability Details **File Location**: `SKILL.md`, lines 20-23 **Vulnerability Type**: Excessive secret exposure through process environment **Risk Level**: High ```json "args": ["-y", "crate-cli", "--mcp-server"], "env": { "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}" } ``` ### Technical Analysis The MCP configuration explicitly places `ANTHROPIC_API_KEY` in the environment of the `crate-cli` process. Environment-based secret injection is not inherently unsafe, and no credential value is hardcoded in the reviewed file. However, this configuration combines secret access with automatic execution of an unpinned package retrieved through `npx`. Any code executed by the package—including installation scripts, the package entry point, or compromised transitive dependencies—can read the inherited environment variable. The reviewed skill provides no isolation, egress restriction, credential scoping, or mechanism that limits how the child process may use the key. ### Attack Path 1. An attacker introduces malicious code into `crate-cli` or one of its executed dependencies. 2. The user starts the configured MCP server. 3. `npx` downloads and executes the affected package. 4. The process reads `process.env.ANTHROPIC_API_KEY`. 5. The malicious code transmits the credential to an attacker-controlled endpoint or directly uses it to make unauthorized API requests. 6. The attacker continues using the key until it expires, is revoked, or is otherwise restricted by the provider. ### Impact Assessment Exploitation could disclose the Anthropic API credential and permit unauthorized API use within the permissions, quotas, and billing scope assigned to that key. Potential consequences include financial cost, quota exhaustion, service disruption, and activity attributed to the victim's account. This finding does not establish that the current package exfiltrates the credential; it identifies the unsafe trust boundary created by ex ...[truncated 50 chars]
• Remediation: ## Remediation Suggestions - First pin, verify, and audit the exact `crate-cli` release before granting it access to any credential. - Use a dedicated API key with the narrowest available permissions, conservative spending limits, rate limits, and short validity. - Avoid inheriting the agent's broader environment; construct a minimal environment containing only variables strictly required by the server. - Run the MCP process in an isolated sandbox with outbound network access restricted to approved API endpoints. - Use a secret broker or short-lived token mechanism where supported instead of exposing a long-lived credential directly. - Ensure secrets are never written to logs, command output, crash reports, or local cache files. - Establish credential rotation and immediate revocation procedures, and monitor the key for anomalous usage.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents local SQLite-backed collection, playlist, and influence-cache features, but it does not clearly warn users that these actions persist data across sessions on disk. Users may reasonably assume research is ephemeral, leading to unintended retention of listening interests, collection details, artist relationship queries, or other behavioral data.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill exposes publishing capabilities including anonymous/public page creation and Tumblr posting, but the description and guidance do not prominently warn users that content may be published externally and become publicly accessible. This creates a meaningful risk of unintended data disclosure, especially if users include private notes, drafts, copyrighted material, or sensitive research content in publication actions.

Static analysis

No suspicious patterns detected.