apple-music
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
apple-music.shscript is vulnerable to AppleScript injection. User-provided arguments such as song names or search queries are interpolated directly into AppleScript command strings within double quotes without escaping. An attacker capable of influencing the agent's input could provide a payload containing escaped quotes and AppleScript operators to execute arbitrary commands on the host system via thedo shell scriptfeature. - [EXTERNAL_DOWNLOADS]: The
auth.htmlcomponent fetches the MusicKit JS library from Apple's official CDN atjs-cdn.music.apple.com. This is a well-known service and is a safe dependency for the skill's intended functionality. - [SAFE]: The skill correctly manages sensitive API tokens by storing them in a local
config.jsonfile and explicitly setting restrictive file permissions (chmod 600) during the setup process to prevent unauthorized access by other local users.
Audit Metadata