ClawHub
Back to skill

Security audit

Chord Analyzer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local audio chord analyzer with some usability and dependency hygiene issues, but no hidden or purpose-mismatched behavior.

Install it in a dedicated Python virtual environment, consider pinning dependency versions, and review or edit the hardcoded audio path before running. Expect Chinese console output unless you modify the script.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-42
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
metadata: { "openclaw": { "emoji": "🎸", "requires": { "bins": ["python3"], "pip": ["librosa", "numpy"] } } }
bash
pip3 install librosa numpy scipy scikit-learn soundfile

Technical Analysis

The skill declares and recommends installing several packages without version constraints, package hashes, a lockfile, or an isolated-environment requirement. Consequently, package resolution depends on mutable package-index state at installation time.

The reviewed package names do not themselves demonstrate dependency confusion or typosquatting. Nevertheless, unpinned installation means future incompatible or compromised releases could be installed without further review. Python dependencies and their transitive dependencies may execute code during installation or when imported by chord_analyzer.py.

Attack Path

  1. A user or agent follows the installation instructions in SKILL.md.
  2. pip3 resolves the latest available versions and transitive dependencies from its configured package index.
  3. An upstream package, dependency, or package-index account is compromised, or a future release introduces malicious installation or import-time behavior.
  4. The unsafe package is downloaded and executed in the context of the user running pip3 or the analyzer.
  5. If installation is performed outside a virtual environment, the affected packages may also alter the user's shared Python environment.

Exploitation therefore requires compromise or unsafe mutation of an upstream dependency or configured package source; no direct malicious package is present in the reviewed project.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary Python code with the privileges of the user performing installation or running the analyze ...[truncated 247 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed requirements file containing exact versions for all direct and transitive dependencies.
  2. Generate and verify cryptographic hashes, then install with:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  3. Use a dedicated virtual environment rather than the global Python environment:
    bash
    python3 -m venv .venv
. .venv/bin/activate
  4. Configure trusted package indexes explicitly and avoid unreviewed mirrors.
  5. Add automated dependency vulnerability and integrity scanning.
  6. Keep SKILL.md metadata synchronized with the complete locked dependency set and document the supported Python version.

T09 · Insecure Skill Coding Practices

Note
Location
chord_analyzer.py:157
Finding

Beatless or Pathological Audio Can Terminate Analysis

Content
View full analysis

Vulnerability Details

File Location: chord_analyzer.py, lines 157-167
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable Code

python
# 每小节的拍数（假设）
beats_per_measure = 4
frames_per_beat = len(chromagram[0]) // len(beat_frames)

# 分析和弦走向（每小节取一个和弦）
print("\n🎸 和弦走向分析...")
chords = []
chord_durations = []

# 每小节（约 4 拍）采样一次
samples_per_measure = frames_per_beat * beats_per_measure

for i in range(0, len(chromagram[0]), samples_per_measure):

Technical Analysis

The result of beat detection is used as a divisor without checking whether any beats were detected:

python
len(chromagram[0]) // len(beat_frames)

Silent, beatless, extremely short, or otherwise unsuitable audio can cause librosa.beat.beat_track() to return an empty beat_frames array. In that case, the expression raises ZeroDivisionError.

A second failure mode exists if the integer division evaluates to zero. This makes samples_per_measure zero, after which range() raises ValueError because its step cannot be zero. Although the script's top-level exception handler prints the error, the requested analysis is terminated and no result is produced.

Attack Path

  1. An attacker or untrusted user provides a silent, beatless, extremely short, or pathological audio file for analysis.
  2. librosa.load() loads the file and beat detection returns no beat frames, or a frame-to-beat ratio that truncates to zero.
  3. Line 157 divides by zero, or line 167 receives a zero iteration step.
  4. An exception aborts analyze_audio().
  5. The caller receives no analysis result; when run as a script, only an error and traceback are printed.

Impact Assessment

The impact is denial of service for the current analysis operation. An attacker can cause predictable processing failure whenever they control or influence the analyzed audio input. The issue does not grant additional privi ...[truncated 191 chars]

Remediation
View remediation

Remediation Suggestions

Validate beat-detection output before performing arithmetic and guarantee a positive sampling interval:

python
frame_count = chromagram.shape[1]

if frame_count == 0:
    raise ValueError("No analyzable chroma frames were extracted from the audio.")

if len(beat_frames) == 0:
    # Use a bounded time-based fallback when no beat is detectable.
    samples_per_measure = max(1, int((2.0 * sr) / 2048))
else:
    frames_per_beat = max(1, frame_count // len(beat_frames))
    samples_per_measure = max(1, frames_per_beat * beats_per_measure)

for i in range(0, frame_count, samples_per_measure):
    end_idx = min(i + samples_per_measure, frame_count)
    if end_idx <= i:
        continue
    slice_chroma = np.mean(chromagram[:, i:end_idx], axis=1)

Additionally:

  1. Reject empty, corrupted, or unreasonably short audio with a clear validation error.
  2. Define maximum duration and decoded sample limits to constrain resource consumption.
  3. Return structured errors instead of exposing a full traceback during normal CLI use.
  4. Add regression tests for silence, beatless tones, empty files, very short clips, and malformed audio.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The sample output shows all user-facing result labels in Chinese (e.g. 调性, 速度, 和弦走向) with no indication that language is configurable or chosen by the user. This creates a natural-language locale policy concern because the skill appears to impose a specific language without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains natural-language descriptions and user-facing console output in Chinese, beginning with the module docstring and continuing throughout the script. Because the skill does not offer any language selection or opt-in, it imposes a specific language on users, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.