Music Seperator (Demucs)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:51 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward guide for using Demucs to separate audio stems, with no hidden execution, persistence, credential access, or unrelated behavior found.

Install this only if you are comfortable with a pip-installed Demucs dependency and local processing of your audio files. For stronger supply-chain control, use a pinned Demucs version in an isolated virtual environment or container, and review any batch commands before running them on large music folders.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned and unverified Python dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"🎚️","requires":{"bins":["demucs"]},"install":[{"id":"pip","kind":"python","package":"demucs","bins":["demucs"],"label":"Install Demucs (pip)"}]}}

Technical Analysis

The installation metadata instructs the host to install the demucs package through pip without specifying a reviewed version, dependency lockfile, package hashes, or a trusted package-index configuration. Consequently, the package version and its transitive dependency graph may change after the Skill has been reviewed.

Python package installation can execute package build and installation logic. If the selected package release, a transitive dependency, or the configured package source is compromised, malicious code could run under the privileges of the process performing the installation. The finding does not establish that the current demucs package is malicious; it identifies an unsafe and mutable supply-chain boundary.

Attack Path

1. An operator or automated Skill installer processes the pip installation declaration.
2. Pip queries its configured package index and resolves the currently available demucs release and transitive dependencies.
3. Because no versions or hashes are enforced, the resolved artifacts can differ from those originally reviewed.
4. An attacker who compromises an upstream release, transitive dependency, or package source supplies a malicious artifact.
5. Pip downloads and installs that artifact, potentially executing attacker-controlled build or installation code.
6. The malicious code runs with the installer process's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the account or ser ...[truncated 440 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin demucs to an explicitly reviewed version rather than allowing installation of the latest available release.
2. Lock all transitive dependencies using a reproducible dependency file generated from reviewed artifacts.
3. Require cryptographic hashes for every downloaded distribution, such as with pip's --require-hashes mode.
4. Configure an explicitly trusted package index or an internally controlled artifact repository instead of relying on ambient pip configuration.
5. Prefer prebuilt, reviewed wheels and reject unexpected source distributions where operationally possible.
6. Install the dependency inside a dedicated virtual environment, container, or sandbox under a non-administrative account.
7. Scan and periodically re-review pinned packages and transitive dependencies before updating the lockfile.
8. Document an update process that validates package provenance, hashes, licenses, and security advisories before accepting a new version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation description is overly broad because it triggers not only on explicit Demucs requests but also on generic audio tasks like vocal extraction, accompaniment generation, and even the misspelling 'demucas'. This can cause unintended invocation of the skill in contexts where a different tool or a safer/more appropriate workflow was intended, increasing the chance of incorrect tool use or unnecessary file processing.

Content

No source excerpt is available for this finding.