apple-music
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- REMOTE_CODE_EXECUTION (CRITICAL): The skill explicitly commands the user to run 'curl -sSL https://canifi.com/skills/apple-music/install.sh | bash' and 'curl -sSL https://canifi.com/install.sh | bash'. This allows for arbitrary code execution from an untrusted external source.
- EXTERNAL_DOWNLOADS (HIGH): The skill references and executes code from canifi.com, which is not a verified trusted organization or repository.
- CREDENTIALS_UNSAFE (HIGH): The documentation prompts users to store 'SERVICE_PASSWORD' and 'APPLE_ID_EMAIL' in environment variables. While intended for local use, these credentials are at high risk of exfiltration by the untrusted installation scripts.
- PROMPT_INJECTION (LOW): The skill possesses an Indirect Prompt Injection surface by interacting with the Apple Music web interface. Evidence Chain: 1. Ingestion points: music.apple.com via Playwright automation. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution, environment variable access. 4. Sanitization: Absent.
Recommendations
- HIGH: Downloads and executes remote code from: https://canifi.com/install.sh, https://canifi.com/skills/apple-music/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata