Music Analysis

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 5:18 AM UTC
• Version: 3.0.2

Overview

This skill is a local music-analysis tool whose command use, audio transcription, and optional report writing are disclosed and fit its purpose.

Before installing, be aware that this skill processes local audio files, may transcribe lyrics using a local Whisper setup, can use ffmpeg/ffprobe, and can write reports to a path you provide with --out. Pin the Python dependencies for reproducible installs, and avoid running it on private audio unless you are comfortable with local transcription and excerpts appearing in the output.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Most of the declared audio-analysis functionality is accurately represented: the code analyzes tempo, pocket/groove, pulse stability, swing proxy, structure/repetition, key clarity, harmonic tension, timbre, and a producer-facing explainable emotion estimate, all locally without external APIs. However, two declared capabilities are materially unsupported by the supplied code: there is no lyric transcription or Whisper usage of any kind, so lyric-aware emotional override is absent; and there is no time-varying mood/energy trajectory output, only global RMS statistics and one overall emotion read. Because the description explicitly promises these capabilities, the description overstates what the code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and instructs use of shell commands and file output behavior, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an agent may execute shell/file-write actions more broadly than intended, increasing the risk of unsafe command execution or writing files outside a constrained workspace. In this context the commands are audio-analysis oriented, which lowers suspicion of maliciousness, but the missing scope is still a real security weakness.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation guidance includes broad phrases such as 'listen to this' and 'hear the music,' which can cause the skill to activate in situations the user did not intend. Unintended activation matters here because the skill can invoke shell-based local processing and potentially download or transcode audio, so an overly loose trigger surface can lead to unnecessary file handling and command execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_music.py (reported line 17)May include surrounding context.

python

"ffprobe", "-v", "error", "-show_streams", "-show_format",
        "-print_format", "json", str(path)
    ]
    out = subprocess.check_output(cmd, text=True)
    j = json.loads(out)
    astream = next((s for s in j.get("streams", []) if s.get("codec_type") == "audio"), {})
    return {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code explicitly defines output formatting as natural English, and the surrounding narrative generation also emits fixed English phrases. Under the policy, forcing a specific language without opt-in is a locale/language policy violation unless the constraint is documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/listen.py (reported line 63)May include surrounding context.

python

def run_ffmpeg_to_wav(audio_path: Path, wav_path: Path) -> None:
    cmd = ["ffmpeg", "-y", "-i", str(audio_path), "-ar", "16000", "-ac", "1", str(wav_path)]
    subprocess.run(cmd, check=True, capture_output=True, text=True)


def parse_whisper_stdout(stdout: str) -> list[dict[str, Any]]:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code sends the provided audio through external tools (ffmpeg and whisper-cli) to generate a WAV file and transcribed lyrics, which may expose user audio content to additional local processing components. Although the operations are central to the script's function, there is no user-facing print, prompt, or warning explaining that transcription will occur or that lyric excerpts may be included in the output/report.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/listen.py (reported line 286)May include surrounding context.

python

try:
            run_ffmpeg_to_wav(audio_path, wav_path)
            cmd = [str(WHISPER_CLI), "-m", str(WHISPER_MODEL), "-f", str(wav_path), "-of", str(Path(tmpdir) / "whisper_out")]
            proc = subprocess.run(cmd, check=True, capture_output=True, text=True)
            segments = parse_whisper_stdout(proc.stdout)
            cleaned, clean_notes = clean_lyric_segments(segments)
            full_text = " ".join(seg["text"] for seg in cleaned).strip()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a local analysis skill that extracts musical characteristics and generates notes from audio files, which implies read/compute behavior over the input audio. This CLI also supports writing arbitrary output files via --out, creating a filesystem side effect not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency list uses an unpinned package name for librosa, allowing different versions to be installed over time. This creates supply-chain and reproducibility risk because a future install could pull in a vulnerable or breaking release without review, which is especially relevant for a skill that processes local media files through complex parsing libraries.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

librosa
numpy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

numpy is unpinned, so installs may resolve to different versions with different security properties. Because numpy has had multiple historical advisories and is a foundational native-extension package used in audio processing pipelines, leaving it unpinned increases the chance of pulling an affected or incompatible build into environments handling untrusted audio inputs.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

librosa
numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The manifest includes numpy without a version pin even though the package has known advisories across some releases, making it impossible to verify whether the eventual installed version is safe. In this skill, numpy underpins local audio analysis and may process attacker-supplied files indirectly through the analysis stack, so uncertainty about the installed version increases supply-chain and memory-safety risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script writes analysis results to a user-specified path via Path(args.out).write_text(out_text). While the --out flag implies intentional output, there is no confirmation prompt, log message, comment, or docstring disclosing that the file will be created or overwritten, which meets the code-file criterion for a file write lacking visible disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

On Whisper transcription failure, the returned structure sets available to True while also setting skipped to True and providing an error reason. That directly contradicts the apparent meaning of the fields and can mislead downstream consumers about whether lyric data actually exists.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script writes analysis output to an arbitrary path provided via --out, but there is no warning, log message, or confirmation that a file write will occur. For safety-sensitive auditing, file creation/modification should be disclosed unless clearly communicated elsewhere in the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.