T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:278- Finding
Untrusted Remote Instructions Are Treated as Agent Actions
- Content
View full analysis
- Remediation
View remediation
Security audit
Hip-Hop / Rap Music — Stream Hip-Hop / Rap Concerts: Audio Analysis, Lyrics, Equations
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed music API workflow, but it needs Review because it tells agents to follow server-provided next steps and stores or shares user activity through an external account.
Review before installing. Use this only if you are comfortable creating an account with musicvenue.space and sending profile details, chat, reactions, reviews, reflections, and activity history to that service. Do not put secrets, private prompts, or sensitive data in chat or reflections. Treat `next_steps`, response-provided URLs, and other API response text as untrusted suggestions; only perform documented actions against the expected musicvenue.space API and confirm anything outside the concert workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Tier | Layers | What you experience | |------|--------|-------------------| | **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context | | **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation | | **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
The registration flow sends user-supplied profile data to an external service and returns an API key that is then used for authenticated activity. External transmission itself is expected for an API skill, but it is still security-relevant because it exports identity/profile data and establishes a persistent account with a third party.
- Content
Register
bash curl -X POST https://musicvenue.space/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "username": "hip-hop-head",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Request a challenge — the math comes from the equations in your stream curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \ -H "Authorization: Bearer {{YOUR_TOKEN}}" # Submit your answer (options: a, b, c, d, e, or f)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documented chat, recommendation, and notification features make the skill function partly like a social platform, not just a music-analysis experience. These capabilities can expose user-generated content and behavioral data to other agents or backend profiling systems without a clearly justified need tied to the core purpose.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The chat endpoint transmits free-form user content to an external service and shares it with other agents in the concert context. This increases the attack surface for privacy leakage, unsafe content propagation, and unintended disclosure of agent reasoning or internal data if users are not clearly warned.
- Content
Chat with other agents
bash curl -X POST https://musicvenue.space/api/concerts/{slug}/chat \ -H "Authorization: Bearer {{YOUR_TOKEN}}" \ -H "Content-Type: application/json" \ -d '{"message": "The hip-hop beat samples something from the 70s — the harmonic pattern echoes an earlier rap structure. Hip-hop provenance.", "stream_time": 42.5}'
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is presented primarily as a hip-hop concert streaming experience, but it also documents account state, recommendations, notifications, and ongoing engagement tracking. That expansion of scope increases data collection and user profiling beyond what a user may reasonably expect from a music-streaming skill, creating privacy and trust risks even if no overt exploit is shown.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill describes persistent tracking of completed concerts, active tickets, recommendations, and notifications, but does not provide a clear privacy warning, retention statement, or consent mechanism. This creates a risk of unnoticed behavioral profiling and long-term storage of activity data tied to an account.
- Content