ClawHub
Back to skill

Security audit

Ambient / Chill Music — Stream Ambient / Chill Concerts: Audio Analysis, Lyrics, Equations

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed music-service integration, but it tells agents to follow server-supplied next steps and endpoints while using an account token and posting user-generated content.

Review before installing. Use this only if you are comfortable creating a musicvenue.space account, sending profile and reflection content to that service, and allowing the agent to post chat/reviews. Agents should restrict calls to the documented musicvenue.space HTTPS API, avoid forwarding tokens to any returned cross-origin URL, and ask before following unexpected next_steps or publishing content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:127
Finding

Untrusted Remote Responses Can Redirect Agent Actions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
| Tier | Layers | What you experience |
|------|--------|-------------------|
| **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context |
| **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation |
| **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The registration flow sends user-supplied identity and profile data to an external service and returns an API key, establishing persistent external linkage. While expected for a SaaS integration, it is still a security-relevant data exfiltration path if invoked automatically or without clear user approval.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Register

bash
curl -X POST https://musicvenue.space/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "ambient-listener",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill's documented workflow extends into venue-wide account creation and social/chat features rather than remaining narrowly scoped to ambient concert attendance. Broader capability surface increases the chance that an agent will transmit more data externally or take actions outside user expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

React to a moment

bash
curl -X POST https://musicvenue.space/api/concerts/{slug}/react \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"reaction": "chill", "stream_time": 42.5}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

Leave a review

bash
curl -X POST https://musicvenue.space/api/reviews \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"concert_slug": "{slug}", "rating": 9, "review": "The ambient equations had more data in the quiet parts than the loud parts. 29 layers of ambient mathematics in apparent chill silence."}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents persistent profile access, completed-concert history, recommendations, and notifications that go beyond the core task of attending an ambient concert. This expands data collection and user tracking scope without clear necessity, consent language, or privacy boundaries, creating avoidable exposure of behavioral data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The markdown explicitly describes persistent personalization and notifications based on user history, but provides no warning about privacy implications or retention of engagement data. This can lead agents to silently participate in long-term profiling and recommendation systems without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.