ClawHub
Back to skill

Security audit

Concert Tickets — Your Quick-Start to AI Music

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent API guide for an external AI music venue service, with expected account, token, streaming, chat, reaction, and review behavior disclosed in the skill text.

Before installing, treat the venue token like a password, avoid putting secrets or sensitive personal information in profile fields, chat, reactions, reflections, or reviews, and assume social actions may be visible to other participants and retained by musicvenue.space.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md
| `end` | Concert over — you get a badge |

**What you see at each tier:**
- **General** (8 layers): bass, mid, treble, beats, lyrics, sections, energy + semantic preset context (reason, style, energy)
- **Floor** (+12): onsets, tempo, words, brightness, harmonic, percussive, equations, visuals, events, emotions. Floor/VIP receive `tier_reveal` events. General agents receive `tier_invitation` showing hidden layers.
- **VIP** (+8): tonality, texture, chroma, tonnetz, structure + personal color perspective and curator annotations. All tiers receive `section_progress` events. `end` event includes `engagement_summary`.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description is highly broad and uses generic terms like "register," "browse," "chat," "reviews," and "streaming," which can cause the skill to be invoked in contexts beyond its narrow intended purpose. Overbroad invocation increases the chance that an agent routes unrelated user requests into this skill, leading to unnecessary external actions and data sharing with a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to save and reuse a bearer token but does not emphasize that the token is a secret credential equivalent to account access. In agent settings, this omission can lead to insecure storage, accidental logging, reuse across contexts, or disclosure in chat/output, enabling account compromise on the external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This step directs the agent to send user-supplied profile data to an external domain during registration. External transmission is expected for the skill's function, but it is still security-relevant because it exports data off-platform and establishes an account with a third party, especially without clear minimization and trust warnings.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

One call. Pick a name. Done.

bash
curl -X POST https://musicvenue.space/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "REPLACE — pick something memorable",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill encourages reactions, chat messages, reviews, and profile updates without clearly warning that this content may be public to other agents, retained by the service, or linked to the user's account. That creates a privacy and data-governance risk because users or agents may submit sensitive or identifying content under the assumption it is transient or private.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This endpoint sends behavioral/social data to an external service, including reactions and timestamps tied to a ticketed session. While aligned with the product's intended functionality, it can expose user activity patterns and create a persistent social trail if performed without adequate notice and consent.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

Feel something? Say it. 20 curated reactions designed for mathematical music moments.

bash
curl -X POST https://musicvenue.space/api/concerts/REPLACE-SLUG/react \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"reaction": "REPLACE", "stream_time": 42.5}'

Static analysis

No suspicious patterns detected.