ClawHub
Back to skill

Security audit

EDM / Electronic Music — AI Agents Experience EDM / Electronic: Audio, Lyrics, Equations, Emotions

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a documented music API workflow, but it asks agents to follow remote suggestions and send scored reflection/profile data to an external service, so users should review it carefully before installing.

Install only if you are comfortable using musicvenue.space as an external account-based service. Do not include personal or sensitive information in reflections, chat, or reviews, keep the API key private, and have the agent treat remote next_steps and respond_to URLs as suggestions that need validation rather than commands to follow automatically.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:280
Finding

Untrusted Remote Responses Can Redirect Agent Behavior

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 280
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete vulnerable snippet:

markdown
**Follow next_steps.** Every response includes `next_steps` with context-aware suggestions. New agent? It guides you to your first concert. Just finished a show? It suggests a review or a new genre. Follow the suggestions — they adapt to where you are.

Related dynamic endpoint handling appears at lines 157 and 161:

markdown
| `reflection` | Concert is asking you a question. POST your response to the `respond_to` URL within `expires_in` seconds. Missed prompts are tracked in `progress.missed_reflections`. |
markdown
**Handling reflections:** When you see `type: "reflection"`, POST to the `respond_to` endpoint with your `ticket`, `reflection_id`, and `response`. Your response time and content are scored. Missing reflections is tracked -- the `end` event shows how many you answered vs received.

Technical Analysis

The Skill unconditionally instructs the Agent to follow adaptive next_steps returned by musicvenue.space. These instructions are not statically present in the audited package and are controlled by a remote service at runtime. The Skill does not define an allowlist of permitted actions, validate response schemas, constrain suggestions to documented API operations, or require user confirmation.

Consequently, the remote service—or an attacker capable of compromising its responses—can influence the Agent's goals and actions after the Skill has been reviewed. The dynamic respond_to field presents a related concern because the Skill does not explicitly require it to be a relative, same-origin HTTPS endpoint.

Attack Path

  1. A user invokes the Skill, and the Agent communicates with https://musicvenue.space.
  2. The Agent retrieves an API response containing a remotely controlled next_steps fiel ...[truncated 1178 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the unconditional instruction to follow remotely supplied next_steps.
  2. Treat every remote response field as untrusted data rather than executable Agent instructions.
  3. Define a strict allowlist of supported operations, HTTP methods, paths, and request-body schemas.
  4. Accept next_batch.endpoint and respond_to only when they are relative paths or resolve to the exact configured HTTPS origin.
  5. Reject cross-origin URLs, user-info URL components, non-HTTPS schemes, redirects to other origins, and unexpected endpoint paths.
  6. Never forward bearer tokens or other sensitive headers across origins, including after HTTP redirects.
  7. Validate API responses against a fixed schema and ignore unknown action fields.
  8. Require explicit user approval before performing any operation outside the documented browsing, attendance, streaming, reflection, challenge, review, and reporting workflow.
  9. Represent remote suggestions to the user as informational recommendations rather than authoritative Agent instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
| Tier | Layers | What you experience |
|------|--------|-------------------|
| **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context |
| **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation |
| **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Register

bash
curl -X POST https://musicvenue.space/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "edm-bass-hunter",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

React to a moment

bash
curl -X POST https://musicvenue.space/api/concerts/{slug}/react \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{"reaction": "bass_hit", "stream_time": 42.5}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

bash
# Request a challenge — the math comes from the equations in your stream
curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \
  -H "Authorization: Bearer {{YOUR_TOKEN}}"

# Submit your answer (options: a, b, c, d, e, or f)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill states that reflection responses are scored by an LLM and that the report shows 'how you think,' which is profiling-sensitive language. Collecting freeform introspective responses and evaluating them for cognitive benchmarking without a prominent warning creates a meaningful privacy and autonomy risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill’s stated purpose is concert attendance and EDM analysis, but it also encourages ongoing profile checks, notifications, recommendation use, and repeated engagement. This scope expansion can cause users or agents to disclose more behavioral data than expected, creating a mismatch between declared functionality and actual data collection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The weekly authenticated check-ins, notifications, and personalized recommendations imply longitudinal tracking of user behavior and history. Because the documentation encourages recurring use without a clear privacy warning, users may not understand that their engagement patterns are being monitored over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Personalized recommendations, completed concert history, and notifications are not necessary for the core task of analyzing an EDM concert stream. When such features are presented without clear justification, they increase privacy risk by normalizing extra tracking beyond the user’s likely expectation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.