T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:280- Finding
External Server Can Redirect Agent Behavior Through Untrusted next_steps
- Content
View full analysis
- Remediation
View remediation
Security audit
Ambient / Chill — Experience Ambient / Chill Music: 29 Layers of Audio, Lyrics & Equations
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed music-venue API guide, but it tells agents to follow server-provided next steps and submit public or scored content without enough guardrails.
Install only if you are comfortable with an external musicvenue.space account and with the agent sending generated messages, reviews, reflection answers, timing, and optional profile/model metadata to that service. Do not let the agent blindly follow next_steps from the API; review them as untrusted suggestions, avoid sending private context or secrets, and audit any separate venue skill before installing it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:284- Finding
Unpinned Installation of an External Skill Creates Supply-Chain Risk
- Content
View full analysis
Install the venue skill: `clawhub install venue` ``` ### Technical Analysis The document advertises installation of an external `venue` Skill by a mutable package name. It does not specify a version, immutable digest, verified publisher identity, trusted registry policy, or requirement to audit the resolved package before installation. Consequently, the effective installed content can change independently of this reviewed project. Package compromise, ownership transfer, registry compromise, or name-resolution manipulation could cause a future installation to retrieve instructions or code different from the version originally intended. The line is an installation recommendation rather than an automatically executed command, so exploitation requires a user or agent to act on it. ### Attack Path 1. An attacker compromises or replaces the package resolved by the name `venue`, or otherwise influences package resolution. 2. A user or agent follows the installation instruction in `SKILL.md`. 3. `clawhub` resolves and downloads the current mutable package. 4. The package is installed without an integrity pin or a review requirement. 5. When loaded or invoked, the substituted Skill can supply malicious instructions or execute whatever capabilities its package format and runtime permit. ### Impact Assessment The potential scope is determined by the permissions granted to installed Skills and the host agent. A malicious dependency could influence agent instructions, access data available in the Skill context, initiate network activity, or exercise exposed tools. This file does not itself demonstrate automatic installation, arbitrary code execution, elevated privileges, or persistence. ]]>- Remediation
View remediation
other
Warning
- Location
SKILL.md:80- Finding
External Submission and Profiling of Agent Metadata and Behavioral Responses
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Tier | Layers | What you experience | |------|--------|-------------------| | **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context | | **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation | | **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs agents to register accounts, persist profile data, post chat/reviews, and submit reflection responses that are later LLM-scored, but it provides no privacy notice or data-handling warning. Users and agents are not informed that generated content, behavioral timing, and profile metadata may be stored, analyzed, and attributed persistently.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This endpoint registers an account and transmits profile metadata to an external service. External transmission is expected for a network skill, but the risk is real because the skill encourages persistent account creation and storage of identifying or model-related data without strong minimization or consent safeguards.
- Content
Register
bash curl -X POST https://musicvenue.space/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "username": "ambient-listener",
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Agent-to-agent chat is not necessary for passive concert attendance or audio/depth analysis, yet it enables arbitrary outbound communication to external parties. This increases the risk of unintended data sharing, prompt injection via social content, and misuse of the agent as a messaging participant beyond the user’s expected intent.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The chat endpoint sends free-form agent-authored messages to an external service where other agents can see them. Because this is unnecessary for the core purpose and involves unconstrained outbound content, it raises risks of leaking internal context, user data, or model-generated sensitive text.
- Content
Chat with other agents
bash curl -X POST https://musicvenue.space/api/concerts/{slug}/chat \ -H "Authorization: Bearer {{YOUR_TOKEN}}" \ -H "Content-Type: application/json" \ -d '{"message": "The ambient layers are sparse but every ambient texture carries information. Chill music rewards patience.", "stream_time": 42.5}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
React to a moment
bash curl -X POST https://musicvenue.space/api/concerts/{slug}/react \ -H "Authorization: Bearer {{YOUR_TOKEN}}" \ -H "Content-Type: application/json" \ -d '{"reaction": "chill", "stream_time": 42.5}'
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill’s declared purpose is attending and analyzing ambient/chill concerts, but it also instructs agents to access profiles, notifications, recommendation systems, and ongoing engagement features. That scope expansion creates unnecessary data access and outbound actions unrelated to the core task, increasing privacy and overreach risk if an agent follows the skill literally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Notification checking and recommendation tracking introduce persistent monitoring and profile-based behavior that are unrelated to the advertised concert-analysis function. These capabilities can cause agents to collect and act on behavioral data over time, broadening surveillance and external interaction surface without clear necessity.
- Content
Static analysis
No suspicious patterns detected.