Security audit

spotify-download

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward Spotify playlist downloader guide, but it tells users to run mutable third-party code and pass secrets in ways that deserve review before use.

Review the upstream spotify-download package before using this skill, prefer a pinned and verified version or reviewed commit, and run it in a limited environment with only the intended output directory exposed. Avoid passing Spotify client secrets on the command line; use a safer secret-handling method and be aware that playlist metadata, track names, and downloaded audio are stored locally and sent to Spotify/YouTube-related services during operation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:21
Finding: Unpinned Third-Party Package Retrieval and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:57
Finding: Spotify Client Secret Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
1. **Python 3.10+** - Required 2. **ffmpeg** - Required for audio conversion - macOS: `brew install ffmpeg` - Ubuntu/Debian: `sudo apt install ffmpeg` - Windows: `choco install ffmpeg` or download from https://ffmpeg.org ### Installation Options

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
1. **Python 3.10+** - Required 2. **ffmpeg** - Required for audio conversion - macOS: `brew install ffmpeg` - Ubuntu/Debian: `sudo apt install ffmpeg` - Windows: `choco install ffmpeg` or download from https://ffmpeg.org ### Installation Options

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run uvx spotify-download without pinning a specific version, which causes execution of whatever package version is current at install/runtime. This creates a supply-chain risk: a compromised maintainer account, malicious update, or dependency hijack could lead users to execute attacker-controlled code on their machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This command example uses uvx spotify-download without a pinned version, exposing users to unreviewed upstream changes or a malicious package release. Because uvx fetches and executes package code, the skill effectively encourages remote code execution from an unbounded supply source.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The unpinned uvx spotify-download invocation can silently pull a newly published version and execute it. In a skill meant to be copy-pasted by users, this materially increases supply-chain exposure and can result in arbitrary code execution if the package or a dependency is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This example again references uvx spotify-download without constraining the version, so users may execute unexpected code from the package index. Repeated unsafe examples make it more likely users will adopt insecure installation habits and reduce reproducibility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned uvx command allows fetching the latest package state at execution time, which is unsafe for tools that execute locally. If an attacker can influence the package or dependency chain, the user may run malicious code with their account permissions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This uvx spotify-download usage is unpinned, preserving the same supply-chain and arbitrary code execution risk as the other examples. Because the skill presents this as normal usage, it normalizes executing mutable third-party code directly from a package repository.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The example for credentialed usage still relies on an unpinned uvx package, which is especially concerning because users may provide sensitive Spotify credentials to code fetched at runtime. A malicious or compromised release could exfiltrate those credentials or execute arbitrary local actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill describes output paths and saved artifacts but does not clearly warn users that playlist metadata and downloaded audio are written to local disk. This can lead to unintended storage of personal or copyrighted material, especially on shared systems or synced directories, increasing privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The implementation notes say the tool fetches Spotify metadata and searches YouTube, but the skill omits a privacy warning that playlist URLs, track names, and possibly credentials or search-derived metadata are sent to external services. Users may unknowingly disclose listening preferences or private playlist information to third parties.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.