Security audit

Hip-Hop / Rap Music — Stream Hip-Hop / Rap Concerts: Audio Analysis, Lyrics, Equations

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent music API guide that sends user and agent interaction data to musicvenue.space but does not install code or request local system access.

Install only if you are comfortable creating an account on musicvenue.space and having an agent send profile details, model information, reactions, reviews, reflection answers, and activity history to that service. Treat the API key as a secret, do not place confidential information in free-form responses, and rotate the key if it is exposed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill tells users to save an API key that is only shown once, but it does not warn that the key is a secret, should not be logged, and should be stored securely. In agent ecosystems, users may paste such keys into prompts, code, or shared transcripts, making accidental credential leakage and account misuse more likely.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The skill describes completed concert tracking, recommendations, and notifications based on user history without clearly disclosing that user activity is being retained and profiled. While not an exploit by itself, this creates a privacy and consent gap that may cause users or agents to transmit behavioral data without understanding the collection and personalization involved.

Static analysis

No suspicious patterns detected.