Music Analysis

• Outcome: Review
• Latest audit: May 28, 2026 · 4:50 AM UTC
• Version: 1.0.0

Overview

The main audio analysis code is coherent, but the bundled setup script makes under-disclosed persistent and remote-install changes that users should review before installing.

Install only after reviewing setup.sh. Prefer running the analysis scripts directly in a controlled environment, pin dependencies, verify the Whisper model download, and remove or manually vet the ~/.zshrc alias block before allowing persistent shell changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes shell execution and file-write capabilities in its documented usage, but declares no permissions. This creates a transparency and consent gap: users or orchestrators may invoke a skill believing it is read-only analysis when it can also write files and run shell commands such as ffmpeg, yt-dlp, and Whisper-related tooling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior claims local analysis without external APIs, yet the broader skill behavior reportedly includes downloading a Whisper model from Hugging Face and modifying ~/.zshrc. Hidden network access and persistence-changing shell profile edits materially exceed the stated purpose, increasing the risk of unauthorized environment changes, supply-chain exposure, and user deception.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill description frames the tool as local music/audio descriptor analysis, but this code additionally transcribes lyrics and stores raw timestamped segments plus concatenated full text in the report. That creates a privacy and data-minimization gap: users may provide copyrighted or sensitive audio expecting feature analysis, while the tool extracts and exposes verbal content that is materially more sensitive than tempo or timbre metadata.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The setup script downloads a large Whisper model from Hugging Face during installation, which contradicts the skill's stated 'local-only' positioning and introduces a supply-chain/network dependency. While not inherently malicious, silent network retrieval of executable-adjacent assets can surprise users, bypass offline expectations, and expose them to tampered or unavailable upstream artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The script appends aliases to ~/.zshrc, creating a persistent change outside the core function of analyzing audio files. Persistent shell modification is security-relevant because it alters the user's environment without necessity, can break existing configs, and normalizes installer behavior that users may not notice or consent to.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Editing persistent shell startup files is not justified by the stated purpose of a music-analysis skill and extends the script's reach beyond dependency setup. In this context, the capability is more dangerous because it grants long-lived influence over future shells, which is unnecessary for local audio analysis and increases the blast radius of any mistake or later abuse.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The skill performs lyric transcription on audio content without an explicit warning that it may process sensitive spoken or sung material. This can lead to unintended handling of personal, copyrighted, confidential, or otherwise sensitive content, especially because transcription converts audio into more easily stored and searchable text.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script changes ~/.zshrc without any interactive confirmation, which violates the principle of informed consent for persistent system modifications. Even though the inserted content is only aliases, writing to startup files silently can unexpectedly affect future sessions and is a risky pattern in installation scripts.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

librosa
numpy

• Confidence: 95% confidence
• Finding: The dependency specification for librosa is unpinned, so installs may resolve to different versions over time. This creates a supply-chain and reproducibility risk because a future release could introduce a vulnerable or incompatible version without any change to the skill itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

librosa
numpy

• Confidence: 98% confidence
• Finding: The dependency specification for numpy is unpinned, which allows package resolution to drift to any available version at install time. In this case the risk is higher because numpy has multiple known advisories across versions, so failing to pin and constrain versions increases the chance of pulling in an affected release.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Declaring numpy without a safe version constraint means the environment may install a version affected by known vulnerabilities, including memory-safety and file-handling issues. Although this skill appears focused on local audio analysis and does not obviously expose network-facing attack surface, it processes untrusted local files and relies heavily on numerical parsing, so vulnerable dependency versions still create meaningful risk.

Static analysis

No suspicious patterns detected.