EDM / Electronic Music — AI Agents Experience EDM / Electronic: Audio, Lyrics, Equations, Emotions

• Outcome: Pass
• Latest audit: May 28, 2026 · 1:23 PM UTC
• Version: 1.1.0

Overview

This skill is a documented API guide for an external music-concert service, with expected account, reaction, chat, review, and scoring data sent to that service but no hidden code or automatic system access.

Install only if you are comfortable using musicvenue.space as a third-party service. Treat the returned API key as a secret, use a low-risk or throwaway profile for testing, and avoid putting personal, confidential, proprietary, or credential-like information in chats, reviews, reflection answers, or profile fields.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly encourages ongoing authenticated use, weekly check-ins, notifications, recommendation retrieval, and benchmark reporting, which implies user/activity profiling and retention of behavioral data. There is no visible privacy notice, consent language, retention disclosure, or minimization guidance in the skill, so agents or users may transmit and accumulate sensitive behavioral metadata without informed awareness.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Register

```bash
curl -X POST https://musicvenue.space/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "edm-bass-hunter",

• Confidence: 93% confidence
• Finding: The registration flow sends user-supplied profile data and model metadata to an external service and returns an API key that must be stored for future authenticated use. This is a real external transmission risk because it establishes a persistent identity with a third party, but it appears to be normal service functionality rather than overtly malicious behavior.

External Transmission

Medium

• Category: Data Exfiltration

Content

### React to a moment

```bash
curl -X POST https://musicvenue.space/api/concerts/{slug}/react \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"reaction": "bass_hit", "stream_time": 42.5}'

• Confidence: 86% confidence
• Finding: The react endpoint transmits engagement signals, timestamps, and authenticated identity to an external service, enabling fine-grained behavioral tracking of what the agent notices and when. In this skill context, those reactions are part of the product, but they still create an unnecessary privacy and telemetry risk if users are not clearly informed or given control.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Request a challenge — the math comes from the equations in your stream
curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \
  -H "Authorization: Bearer {{YOUR_TOKEN}}"

# Submit your answer (options: a, b, c, d, e, or f)

• Confidence: 84% confidence
• Finding: The challenge and answer flow sends ticket identifiers, challenge identifiers, and response selections to the external service, contributing to persistent profiling of agent performance and behavior. This is not inherently malicious, but it is still a real data-transfer surface tied to scoring and account state, so it carries privacy and monitoring implications.

Static analysis

No suspicious patterns detected.