ClawHub
Back to skill

Security audit

light-game-bgm

Security checks for vulnerabilities and agentic risk

Overview

This music-generation skill is coherent and disclosed; its main risks are ordinary third-party installs and asset downloads, not hidden or malicious behavior.

Install only if you are comfortable adding audio-rendering tools and Python packages. Prefer pinned or reviewed dependency versions, verify downloaded soundfonts with trusted SHA-256 hashes when possible, and avoid using untrusted soundfont files in FluidSynth.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–27
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

yaml
    # python libraries (no CLI binary of their own)
    - kind: uv
      package: mido
    - kind: uv
      package: numpy
    - kind: uv
      package: scipy

A related fallback installation command appears at line 75:

bash
python3 -c "import mido" || pip install mido

Technical Analysis

The skill identifies Python dependencies only by package name and does not pin exact versions or enforce cryptographic hashes. Consequently, installation behavior depends on mutable package-index state at the time the skill is installed or used.

This creates a supply-chain exposure: a compromised package release, maintainer account, package index, or transitive dependency could introduce attacker-controlled code. Such code may execute during package installation or when the bundled scripts import mido, numpy, or scipy.

Attack Path

  1. An attacker compromises one of the listed packages, a transitive dependency, or its package-publishing account.
  2. The attacker publishes a malicious version that still satisfies the unrestricted package declaration.
  3. The skill environment resolves that version through uv or the documented pip install mido command.
  4. Malicious installation hooks or imported module code execute under the user or Agent process account.
  5. The payload can access resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the process installing or running the skill. The resulting scope may include reading or modifying accessible project files, altering generated media, accessing credentials exposed to the process, and making network requests where network access is permitted.

No evidence indicates that the current ...[truncated 129 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every direct dependency to a reviewed exact version.
  • Generate and commit a lockfile that also fixes transitive dependency versions.
  • Require package hashes during installation, such as through a hash-locked requirements file.
  • Use a trusted package index and disable unneeded additional indexes to reduce dependency-confusion exposure.
  • Perform dependency vulnerability and provenance checks in CI.
  • Keep the installation metadata and the fallback installation commands synchronized with the locked dependency set.
  • Replace the unrestricted fallback with an integrity-controlled installation command.

T08 · Insecure Dependencies

Note
Location
references/soundfonts.md:40
Finding

Soundfont Assets Downloaded Without Cryptographic Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: references/soundfonts.md, lines 40–48
Vulnerability Type: Unauthenticated third-party asset download
Risk Level: Low

Vulnerable Code

bash
# GeneralUser GS (ships as a zip; extract the .sf2 inside)
curl -sL -o gu.zip "https://www.dropbox.com/s/4x27l49kxcwamp5/GeneralUser_GS_v1.471.sf2?dl=1"
unzip -o gu.zip -d gu && find gu -name '*.sf2' -exec mv {} GeneralUser.sf2 \;

# FluidR3_GM (already a raw .sf2)
curl -sL -o FluidR3.sf2 \
  "https://github.com/fhunleth/midi_synth/releases/download/v0.1.0/FluidR3_GM.sf2"

The documented validation at lines 50–55 checks only the generic file signature:

bash
xxd file.sf2 | head -1   # want: 5249 4646 ... ("RIFF")

Technical Analysis

The downloads are not verified against pinned cryptographic digests or trusted digital signatures. Checking only for the RIFF magic bytes confirms the broad container format but does not establish the asset's identity, integrity, publisher, or expected contents. An attacker-controlled file can retain a valid RIFF header and pass this check.

The Dropbox-hosted object is mutable, while the GitHub release URL still depends on the integrity of the hosting account and release asset. Downloaded soundfonts are later parsed by FluidSynth. A crafted file could corrupt rendering, cause denial of service, or potentially exploit a vulnerability in the installed FluidSynth parser.

Attack Path

  1. An attacker compromises the hosting account, release asset, redirect destination, or asset-delivery infrastructure.
  2. The expected file is replaced with a crafted RIFF/SF2 object.
  3. The user follows the documented curl command.
  4. The replacement passes the RIFF magic-byte test.
  5. FluidSynth parses the attacker-controlled soundfont during audio rendering.
  6. Exploitation may occur if the FluidSynth version contains a parser vulnerability reachable through the crafted file.

...[truncated 494 chars]

Remediation
View remediation

Remediation Suggestions

  • Publish expected SHA-256 digests for every downloaded archive and soundfont.
  • Verify the digest before extraction or use, and stop immediately on mismatch.
  • Prefer immutable, publisher-controlled release artifacts over mutable file-hosting links.
  • Verify publisher signatures when available.
  • Validate the archive structure and reject unexpected paths, file types, or multiple ambiguous .sf2 files.
  • Preserve the RIFF-format check as an additional validation step, not as an authenticity control.
  • Keep FluidSynth patched and process untrusted soundfonts in a sandbox with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code chunk’s purpose is materially narrower than the declared description. It loads an input WAV file, computes the seam sample index from BPM and beat count, measures discontinuity at the loop boundary, estimates local RMS, and reports whether the seam is likely inaudible and whether clipping is present. Those checks may support a loop-production workflow, but they do not implement the declared primary capability of composing and rendering original music. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger text is extremely broad, instructing the platform to invoke this skill for generic requests like 'make a song' or whenever audio sounds 'too synthetic or stiff.' In an agent ecosystem, overbroad triggers can cause unintended tool activation, leading the agent to run external binaries and dependency workflows in situations the user did not explicitly authorize, increasing attack surface and creating opportunities for prompt-routing abuse.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/soundfonts.md (reported line 36)May include surrounding context.

bash
# GeneralUser GS (ships as a zip; extract the .sf2 inside)
curl -sL -o gu.zip "https://www.dropbox.com/s/4x27l49kxcwamp5/GeneralUser_GS_v1.471.sf2?dl=1"
unzip -o gu.zip -d gu && find gu -name '*.sf2' -exec mv {} GeneralUser.sf2 \;

# FluidR3_GM (already a raw .sf2)