apple-music

Fail

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • REMOTE_CODE_EXECUTION (CRITICAL): The skill explicitly commands the user to run 'curl -sSL https://canifi.com/skills/apple-music/install.sh | bash' and 'curl -sSL https://canifi.com/install.sh | bash'. This allows for arbitrary code execution from an untrusted external source.
  • EXTERNAL_DOWNLOADS (HIGH): The skill references and executes code from canifi.com, which is not a verified trusted organization or repository.
  • CREDENTIALS_UNSAFE (HIGH): The documentation prompts users to store 'SERVICE_PASSWORD' and 'APPLE_ID_EMAIL' in environment variables. While intended for local use, these credentials are at high risk of exfiltration by the untrusted installation scripts.
  • PROMPT_INJECTION (LOW): The skill possesses an Indirect Prompt Injection surface by interacting with the Apple Music web interface. Evidence Chain: 1. Ingestion points: music.apple.com via Playwright automation. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution, environment variable access. 4. Sanitization: Absent.
Recommendations
  • HIGH: Downloads and executes remote code from: https://canifi.com/install.sh, https://canifi.com/skills/apple-music/install.sh - DO NOT USE without thorough review
  • AI detected serious security threats
Audit Metadata
Risk Level
CRITICAL
Analyzed
Feb 17, 2026, 05:28 PM
Security Audit — agent-trust-hub — apple-music