Security audit

Real mousic

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to search a music-link site as advertised, but it bundles stealth Chrome automation and broad local process control that need user review before installation.

Install only if you are comfortable with an automated Chrome profile that uses stealth/fingerprint-masking techniques and may close or kill a process on its debug port. Use an isolated profile and port, avoid logging into unrelated accounts in that browser profile, and verify any third-party music links for safety and copyright compliance before opening them.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The module exposes broad browser lifecycle and remote-debugging control that exceeds the stated song search/download purpose. Opening Chrome with a DevTools port and generic process-kill logic can enable unintended access to browser state, cookies, tabs, and automation surfaces if other parts of the skill or local attackers can reach that port or reuse the persistent profile.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The module docstring describes a Chrome DevTools Protocol browser automation package, which is materially inconsistent with a skill advertised only for music search and download. This kind of capability mismatch is dangerous because it can conceal broader browser automation functionality than users or reviewers expect, increasing the risk of hidden scraping, account interaction, or unauthorized web actions.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Documented support for stealth and human-behavior simulation indicates anti-detection measures that are not justified by a simple song search/download skill. In this context, those features could be used to evade platform defenses, automate access in a deceptive way, or mask unauthorized browsing behavior, which substantially raises the likelihood of abuse.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This file embeds a broad Chrome DevTools automation layer with stealth/anti-detection features that goes well beyond a narrowly scoped music search/download capability. In the context of a song-download skill, such generic browser control can be repurposed to interact with arbitrary sites and conceal automation, increasing the risk of policy evasion, account abuse, and unauthorized web actions.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code supports generic file upload via DOM.setFileInputFiles even though file-upload capability is not justified by the skill's stated purpose of searching/downloading songs. In an agent setting, this creates a path for unintended local file access and exfiltration if higher-level logic ever passes sensitive paths into this API.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This file deliberately injects anti-detection JavaScript and launches Chrome with automation-evasion flags to conceal browser automation from websites. For a song search/download skill, this is not necessary for core functionality and materially increases the risk that the skill is designed to bypass platform defenses, anti-bot controls, or access restrictions, which can facilitate scraping or policy evasion.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill is documented to activate from broad natural-language requests like downloading music or searching for songs, which can overlap with ordinary conversation and cause unintended invocation. In an agent environment, this increases the chance the skill runs without sufficiently explicit user intent, leading to unreviewed navigation to third-party sites and retrieval of potentially infringing or unsafe links.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger set contains broad, common phrases related to music requests, increasing the chance the skill activates in contexts where the user did not intend to download or search via this specific third-party workflow. Because the skill can launch CLI commands, access the network, and retrieve download links, accidental invocation can cause unanticipated external access and potentially steer users toward copyright-infringing or unsafe third-party links.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code injects a stealth script and overrides browser characteristics specifically to avoid automation detection, but there is no user-facing disclosure or consent. Hidden anti-detection behavior is risky because it enables deceptive interaction with third-party services and can facilitate abuse while obscuring what the agent is doing on the user's behalf.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: This method can set arbitrary cookies for arbitrary domains without any visible user confirmation or policy checks. In a browser automation context, that can enable session manipulation, account switching, or reuse of authentication state in ways the user may not expect or authorize.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file upload helper performs browser-side file selection with no disclosure, consent, or safety boundary. In practice, silent upload primitives are dangerous in agentic systems because they can be combined with prompts or workflow bugs to send local files to remote services without meaningful user awareness.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The code hard-codes a Chinese language fingerprint by overriding navigator.languages to a fixed locale set, regardless of user settings or environment. On its own this is less severe than the broader stealth logic, but in context it contributes to fingerprint spoofing and deceptive client impersonation, which may be used to evade localization-based controls or make automated traffic appear more human.

Static analysis

No suspicious patterns detected.