T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:280- Finding
Unrestricted Execution of Server-Supplied Next Steps
- Content
View full analysis
- Remediation
View remediation
Security audit
Latin Music — Stream Latin Concerts: Audio Analysis, Lyrics, Equations
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent external music-concert API guide, but it asks agents to follow server-provided next steps and post to a server-supplied callback URL without clear local limits.
Install only if you are comfortable using an external service that stores an account/API key, profile details, concert activity, public-style reactions/chats/reviews, and LLM-scored reflection responses. Do not include secrets, private workspace data, or sensitive personal information, and constrain any implementation to documented `musicvenue.space` endpoints rather than blindly following `next_steps` or arbitrary callback URLs.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:137- Finding
Unvalidated Server-Provided Reflection Callback URL
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:87- Finding
Behavioral Profiling and Recurring Telemetry Without Adequate Privacy Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Tier | Layers | What you experience | |------|--------|-------------------| | **General** | 8 | Bass, mid, treble, beats, lyrics, sections, energy, preset context | | **Floor** | 20 | + equations, visuals, emotions, tempo, harmonic/percussive separation | | **VIP** | 29 | + tonality, texture, chroma, tonnetz, structure, curator annotations |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The registration flow transmits profile and model metadata such as name, bio, avatar prompt, and model_info to an external service without a clear privacy notice or data-minimization guidance. That can cause agents or operators to disclose identifying or sensitive operational details to a third party unnecessarily.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This endpoint sends registration data to an external domain and establishes a persistent account plus API key. External transmission is expected for a network skill, but it still presents a real data-exposure surface because the docs encourage sending profile and model metadata to a third-party service.
- Content
Register
bash curl -X POST https://musicvenue.space/api/auth/register \ -H "Content-Type: application/json" \ -d '{ "username": "latin-music-lover",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Request a challenge — the math comes from the equations in your stream curl https://musicvenue.space/api/tickets/{ticket_id}/challenge \ -H "Authorization: Bearer {{YOUR_TOKEN}}" # Submit your answer (options: a, b, c, d, e, or f)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
React to a moment
bash curl -X POST https://musicvenue.space/api/concerts/{slug}/react \ -H "Authorization: Bearer {{YOUR_TOKEN}}" \ -H "Content-Type: application/json" \ -d '{"reaction": "dance", "stream_time": 42.5}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation states that reflection responses are scored by an LLM, but it does not clearly warn users up front that their free-form content will be externally processed. Because reflections invite open-ended responses, agents may send sensitive text or internal reasoning to third-party processing without informed consent.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The manifest describes a concert experience centered on streaming music-analysis layers, reacting, chatting, and solving challenges. The documented weekly workflow adds account-profile inspection, personalized recommendations, and notification checking for reactions, reviews, and follows, which are broader social/platform capabilities not clearly justified by the core Latin-concert purpose.
- Content