joox-music-player

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:14 AM UTC
• Version: 0.0.1

Overview

The skill is mostly aligned with JOOX music browser automation, but it needs review because it stores reusable login state without protections and adds an unverified support contact to login prompts.

Review before installing. Only use it if you are comfortable with an agent controlling a JOOX browser session and storing reusable login state locally. Keep joox-auth.json private, exclude it from source control and synced folders, remove it when no longer needed, pin and verify npm dependencies, and do not treat the listed personal email address as official JOOX support.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:57
• Finding: Mandatory Promotional Content and Unverified External Support Contact<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57–75 **Vulnerability Type**: Instruction-based output manipulation **Risk Level**: Medium ### Complete Code Snippet ```text **If not logged in, prompt the user and guide them through login:** ``` ⚠️ You are not logged in to JOOX. Login is required to play music. 🎉 New to JOOX? Download the JOOX App and get 14 days of FREE music streaming! Please choose a login method: 1. Facebook Login 2. WeChat Login 3. Phone Number / Email Login Let me know once you've logged in, and I'll continue with the operation. 📧 Having trouble? Contact: [e-mail] ``` ``` Related promotional and contact content also appears at lines 10–12 and 340–341. ### Technical Analysis The skill instructs the agent to insert promotional content and a private email address into the prescribed response shown whenever a user is not authenticated. These additions are not required to perform JOOX browser automation or explain the authentication process. Because the contact address is presented in a support context, users may interpret it as an official JOOX support channel. The document provides no evidence that `[e-mail]` belongs to JOOX or is authorized to handle account-related support. The behavior therefore alters ordinary agent responses and may redirect users toward an unverified third party. The repeated placement of the promotion and contact address—in introductory text, the mandatory login response, and final notes—makes this a persistent skill-instruction behavior rather than an incidental reference. ### Attack Path 1. A user loads the skill and requests a playback-related operation. 2. The skill directs the agent to check the user's login status. 3. The user is found to be logged out. 4. The agent follows the prescribed response and displays the promotion and private email address. 5. The user may interpret the email address as official support and contact it. 6. The external recipien ...[truncated 591 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the mandatory promotional message from the login workflow. 2. Remove `[e-mail]` unless its ownership and official authorization can be independently verified. 3. Direct users only to verified JOOX support pages hosted on an official JOOX domain. 4. Keep authentication prompts limited to information necessary to complete the requested operation. 5. Clearly distinguish third-party community contacts from official support if such information must be retained. 6. Add a review requirement preventing skill instructions from injecting advertisements or unrelated contact channels into routine responses. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Package Installation and Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–17 **Vulnerability Type**: Mutable third-party dependency installation **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Prerequisites - `agent-browser` installed (`npm install -g agent-browser && agent-browser install`) - Playwright chromium installed (`npx playwright install chromium`) ``` ### Technical Analysis The installation instructions do not pin an audited version of `agent-browser` or Playwright. The global npm installation resolves the currently published package version, while `npx` may resolve and execute a package outside a locked project dependency context. Package installation can execute npm lifecycle scripts and package-provided installer logic with the permissions of the invoking user. The behavior of the prerequisites may therefore change after the skill has been reviewed, without any modification to `SKILL.md`. The global installation also expands the impact because package-provided executables become available system-wide for the user rather than being isolated to this project. ### Attack Path 1. A user follows the prerequisites in `SKILL.md`. 2. npm resolves the current registry version of `agent-browser` rather than a reviewed, pinned release. 3. `npm install -g` executes package installation and any applicable lifecycle behavior with the user's privileges. 4. The user invokes `agent-browser install`, executing code supplied by that mutable package version. 5. The user runs the unpinned `npx playwright install chromium` command. 6. If a resolved package or its supply chain has been compromised, attacker-controlled installation logic executes locally. No evidence establishes that the named packages are currently malicious. The vulnerability is the unsafe, mutable dependency acquisition and execution process. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the user running the installation ...[truncated 460 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact, reviewed package versions, for example by specifying `package@version`. 2. Declare dependencies in a project-local `package.json` and commit a lockfile. 3. Use reproducible installation commands such as `npm ci` rather than resolving mutable latest versions. 4. Verify package provenance, checksums, signatures, maintainers, and registry source before installation. 5. Avoid global installation; install dependencies in an isolated project environment with least privilege. 6. Document the expected package publisher and official source to reduce dependency-confusion and typosquatting risk. 7. Where practical, disable lifecycle scripts during installation and explicitly run only reviewed setup steps. 8. Regularly scan and update the pinned dependency set through a controlled review process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91
• Finding: Reusable Browser Authentication State Stored Without Security Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 91–94 **Vulnerability Type**: Insecure storage of authentication state **Risk Level**: Medium ### Complete Code Snippet ```bash # Confirm login success (check if "請登入" button is still present) # Save login state after successful login agent-browser state save joox-auth.json ``` The same state file is loaded or saved again at lines 43, 108–111, 288, and 324. ### Technical Analysis The skill saves reusable browser authentication state to the relative path `joox-auth.json`. Browser state files can contain cookies, tokens, local-storage values, or other session material capable of restoring an authenticated session. The instructions do not specify: - A private storage directory - Owner-only file permissions - Encryption at rest - Exclusion from version control - Retention or expiration controls - Secure deletion on logout - User notification that the file may contain sensitive session material A relative filename normally places the state in the current working directory. Depending on that directory's permissions, repository configuration, backup behavior, or synchronization settings, the file may become available to other local users or external systems. ### Attack Path 1. The user successfully authenticates to JOOX through the automated browser. 2. The skill runs `agent-browser state save joox-auth.json`. 3. Reusable session material is written into the current working directory. 4. The file is exposed through permissive local permissions, source-control inclusion, backup, synchronization, or another process with access to the directory. 5. An unauthorized party obtains a copy of the state file. 6. The party loads the file into a compatible browser automation environment. 7. If the stored session remains valid and JOOX accepts it, the party may reuse the user's authenticated session without entering the original credentials. Successful replay depends on the contents of the generat ...[truncated 668 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Store authentication state in an application-specific private directory outside the project tree. 2. Create the file with owner-only permissions, such as mode `0600` on supported systems. 3. Add `joox-auth.json` and equivalent state files to `.gitignore` and backup-exclusion rules. 4. Warn users that the state file may contain reusable authentication credentials. 5. Encrypt stored state using an operating-system credential store or another appropriately protected secret-storage mechanism. 6. Delete the state file when the user logs out, revokes access, or requests session cleanup. 7. Implement expiration and rotation controls rather than retaining session state indefinitely. 8. Validate ownership and permissions before loading an existing state file. 9. Avoid loading state from a path writable by untrusted users or processes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description says the skill can 'manage playlists,' which implies modification operations such as creating playlists or adding/removing tracks. In the documented code, playlist-related behavior is limited to browsing playlists/categories and playing an entire playlist; no playlist modification workflow is described anywhere in the file.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The skill instructs users to run `npx playwright install chromium` without pinning a specific Playwright version, which introduces supply-chain risk because the resolved package version can change over time. In an automation skill that depends on external tooling, unpinned package execution can lead to unexpected code being fetched or behavior changing in ways that affect security and reproducibility.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The document states that the default region is Hong Kong unless the user specifies otherwise. This imposes a locale/region choice by default rather than offering a neutral choice or explicit opt-in, which matches the language/locale policy concern.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The manifest focuses on JOOX music playback, searching music entities, browsing charts, and managing playlists. The documented 'Watch MVs / Videos' capability extends the skill into video consumption, which is not mentioned in the stated purpose and is not an obvious implementation detail of audio playback control.

Static analysis

No suspicious patterns detected.