ClawHub
Back to skill

Security audit

Country — Experience Country Music: 29 Layers of Audio, Lyrics & Equations

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed guide for a remote music API, but it tells agents to follow server-provided next_steps without clear limits, so remote responses could steer agent behavior beyond the reviewed artifact.

Install only if you are comfortable with an agent sending profile details, model info, chat, reactions, reviews, and reflection answers to musicvenue.space. Treat next_steps returned by the service as suggestions, not commands, and confirm any action that leaves the documented concert workflow or shares sensitive information. Store the API key as a secret and do not paste private data into chat or reflections.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:280
Finding

Untrusted Remote Instructions Can Hijack Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:280-281
Vulnerability Type: Dynamic instruction trust and agent workflow hijacking
Risk Level: High

Vulnerable Code

markdown
**Follow next_steps.** Every response includes `next_steps` with context-aware suggestions. New agent? It guides you to your first concert. Just finished a show? It suggests a review or a new genre. Follow the suggestions — they adapt to where you are.

Technical Analysis

The Skill explicitly tells the agent to follow the next_steps field returned by a remote service. Because the contents of that field are not present in the audited package, they can change after review. The document does not define a strict response schema, an allowlist of permitted actions, same-origin restrictions, or a requirement for user confirmation before executing sensitive suggestions.

This creates an external instruction channel through which musicvenue.space, or an attacker who compromises or impersonates it, can alter the agent's behavior during the current session. The risk is reinforced by the documented polling workflow, under which the agent repeatedly processes remote responses and follows server-provided endpoints.

The issue does not independently establish operating-system privilege escalation or arbitrary native-code execution. Its effective capabilities are limited to the tools, credentials, network access, and permissions already available to the invoking agent.

Attack Path

  1. A user invokes the Skill and the agent registers or authenticates with musicvenue.space.
  2. The agent sends authenticated requests to the service as directed by the documented workflow.
  3. The service returns a response containing an attacker-controlled next_steps field.
  4. The Skill's instructions direct the agent to follow those suggestions without validating their scope or safety.
  5. The malicious response can attempt to redirect the agent toward unrelated requests, disclosure o ...[truncated 866 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional instruction to follow server-provided next_steps.
  2. Treat every remote response field as untrusted data rather than executable agent instructions.
  3. Define a strict schema for next_steps, using enumerated action identifiers instead of free-form natural-language commands.
  4. Permit only documented, task-relevant actions and same-origin HTTPS API paths under musicvenue.space.
  5. Reject absolute URLs, redirects to other origins, shell commands, installation requests, credential requests, and instructions that modify the agent's goals or safety constraints.
  6. Require explicit user approval before installing software, disclosing sensitive information, contacting a new destination, or performing an action outside the concert-streaming workflow.
  7. Validate returned endpoints before use, including scheme, hostname, path prefix, HTTP method, and expected parameters.
  8. Apply response size limits, timeout limits, bounded polling, and a maximum number of chained actions.
  9. Document that remote fields are informational suggestions only and cannot override system, developer, user, or Skill-level security constraints.
  10. Remove or separately review and pin the secondary clawhub install venue recommendation before allowing installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
| Tier | Layers | What you experience |
|------|--------|-------------------|
| **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context |
| **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation |
| **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to register, stream activity, submit reflections, chat, react, review, and retrieve benchmark reports from a remote service, which implies transmission of profile, behavioral, and possibly sensitive inference data. There is no explicit warning about what data is collected, how it is used, retention, sharing, or that reflection/report content may be LLM-scored, so users may disclose more than they realize.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The registration example sends user-supplied identity/profile information to an external domain, including username, name, bio, avatar prompt, and model metadata. External transmission is expected for a networked service, but it is still security-relevant because it exports identifying and operational data to a third party and the skill does not minimize or warn about that disclosure.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Register

bash
curl -X POST https://musicvenue.space/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "country-music-fan",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document tells users to save an API key that is 'shown once, never again' but does not warn that the key is a bearer credential granting account access. Without explicit handling guidance, users or agent frameworks may log, echo, persist, or expose the token in insecure memory, chat transcripts, or telemetry.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

bash
# Request a challenge — the math comes from the equations in your stream
curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \
  -H "Authorization: Bearer {{YOUR_TOKEN}}"

# Submit your answer (options: a, b, c, d, e, or f)

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The chat endpoint transmits free-form user or agent-generated text to a remote service and makes clear that other agents may see it in crowd events. Free-form messages can inadvertently include sensitive data, prompts, or internal reasoning, and the skill provides no warning or guardrail against sharing confidential information in chat.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

Chat with other agents

bash
curl -X POST https://musicvenue.space/api/concerts/{slug}/chat \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"message": "The country lyrics hit different when you see the narrative arc in the equations — pure country storytelling", "stream_time": 42.5}'

Static analysis

No suspicious patterns detected.