Music Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:53 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a real local music-analysis tool, but its installer makes persistent shell-profile changes and downloads/install dependencies without strong integrity controls.

Review setup.sh before installing. Prefer pinning dependencies, verifying the Whisper model checksum, fixing the hard-coded install path, and removing or making opt-in the ~/.zshrc alias modification. Do not run setup as an elevated user.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.sh:32

Finding

Unpinned and Incomplete Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: setup.sh:32-37; related manifest: requirements.txt:1-2
Vulnerability Type: Unpinned third-party dependencies and incomplete dependency manifest
Risk Level: Medium

Vulnerable Code:

bash

# 2. Install Python dependencies
log_info "Installing Python dependencies..."
source "$VENV_DIR/bin/activate"
pip install -q librosa numpy scipy numba scikit-learn soundfile soxr
log_info "Python dependencies installed"

Related dependency manifest:

text

librosa
numpy

Technical Analysis

The installation command requests packages without exact version constraints or cryptographic hashes. Consequently, each execution can resolve a different set of package versions from the configured Python package index.

The installer also directly installs scipy, numba, scikit-learn, soundfile, and soxr, while requirements.txt declares only librosa and numpy. This discrepancy makes the dependency manifest incomplete and prevents reliable review or reproduction of the installed environment.

Python packages may execute package-controlled code during installation, import, or normal use. If an upstream release, package-index account, dependency artifact, or transitive dependency is compromised, running setup.sh could introduce and execute attacker-controlled code under the account invoking the installer.

Attack Path

1. An attacker compromises an upstream package release, its publishing credentials, or one of its transitive dependencies.
2. The attacker publishes a malicious version that satisfies the installer’s unconstrained package names.
3. A user runs setup.sh.
4. pip resolves the malicious release because no approved version or hash is enforced.
5. Malicious package code executes during installation or when the analysis scripts import and use the affected package.

Impact Assessment

Successful exploitation would execute code ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare every direct dependency in a single authoritative dependency file.

2. Pin each package and transitive dependency to an audited exact version.

3. Generate and retain cryptographic hashes for every approved distribution artifact.

4. Install with hash enforcement, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.lock
   

5. Use python3 -m pip rather than an unqualified pip command to ensure installation targets the intended interpreter.

6. Review and update the lock file through a controlled dependency-update process with vulnerability scanning and tests.

7. Keep requirements.txt, the lock file, documentation, and setup.sh synchronized so installation cannot introduce undeclared direct packages.

T08 · Insecure Dependencies

Warning

• Location: setup.sh:41

Finding

Whisper Model Downloaded from a Mutable Source Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: setup.sh:41-48
Vulnerability Type: Unverified third-party model download from a mutable upstream reference
Risk Level: Medium

Vulnerable Code:

bash

# 3. Check Whisper model
if [ -f "$WHISPER_MODEL" ]; then
    MODEL_SIZE=$(du -h "$WHISPER_MODEL" | cut -f1)
    log_info "Whisper model already exists ($MODEL_SIZE)"
else
    log_warn "Whisper model does not exist and must be downloaded (approximately 1.5 GB)..."
    mkdir -p "$WHISPER_MODEL_DIR"
    curl -L -o "$WHISPER_MODEL" "https://huggingface.co/ggerganov/whisper.cpp/resolve/main/ggml-large-v3-turbo.bin"
    log_info "Whisper model download completed"
fi

Technical Analysis

The model URL references the mutable main branch rather than an immutable repository revision. The installer does not verify a cryptographic checksum or digital signature after downloading the file.

TLS protects the transfer channel but does not establish that the retrieved artifact is the exact version reviewed and approved by the project. An upstream repository compromise, unauthorized artifact replacement, or accidental corruption could therefore cause the installer to accept substituted model data.

The downloaded file is subsequently supplied to the native whisper-cli process by scripts/listen.py. Although no malicious model is included in the audited project, processing attacker-controlled binary model data with a native parser increases the consequence of any parser defect and can also silently manipulate transcription results.

The command downloads data rather than executable code, so this is classified as an insecure third-party component rather than confirmed remote payload execution.

Attack Path

1. An attacker compromises the upstream repository, its maintainer credentials, or the artifact associated with the mutable main reference.
2. The attacker replaces the model with crafted or unauthorized ...[truncated 1035 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable main reference with an immutable upstream commit or release revision.

2. Publish an approved SHA-256 digest in the project and verify it before using the model.

3. Download to a temporary file, validate it, and atomically move it into the final model path only after successful verification.

4. Use strict curl options so transport failures are not treated as successful downloads:

   bash

   set -euo pipefail
   tmp_model=$(mktemp "${WHISPER_MODEL}.tmp.XXXXXX")
   curl --fail --show-error --location --proto '=https' \
     --output "$tmp_model" \
     "https://huggingface.co/ggerganov/whisper.cpp/resolve/IMMUTABLE_REVISION/ggml-large-v3-turbo.bin"
   echo "EXPECTED_SHA256  $tmp_model" | shasum -a 256 --check -
   mv "$tmp_model" "$WHISPER_MODEL"
   

5. Prefer a verifiable upstream signature when one is available, and pin the trusted signing identity.

6. Reject existing model files that do not match the approved digest rather than checking only whether a file exists.

7. Document a controlled process for reviewing and updating the pinned model revision and checksum.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

The code is clearly local-only and does not call external APIs, which aligns with part of the description. However, the visible implementation primarily acts as a wrapper: it invokes ffprobe for metadata and delegates substantive analysis to analyze_track in music_analysis_v2, whose behavior is not shown. Because the declared purpose makes detailed claims about tempo, groove, swing, harmonic tension, timbre, mood-energy journeys, and lyric-aware emotional overrides, but this code chunk does not implement or demonstrate those features, the description is not accurately represented by the supplied code alone. The main evidenced behavior is local file existence checking, ffprobe metadata extraction, optional invocation of a local analysis module, and graceful fallback when that analysis is unavailable.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches the core local audio-analysis description: it uses librosa locally, with no external APIs, and computes many of the declared music-analysis features including groove, tempo, structure, harmony, timbre, and explainable emotion. However, two declared capabilities are not implemented in this chunk. First, there is no Whisper integration, no transcription, and no lyric input path, so the claimed lyric-aware emotional override is unsupported. Second, the description promises temporal mood-energy journeys, implying time-varying emotional analysis across the track, but the implementation derives only aggregate energy stats and one overall emotion read for the whole file. These are material description/behavior mismatches, even though the primary purpose remains music analysis.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and demonstrates shell execution and report output behavior but does not declare any explicit tool scope or allowed-tools boundary. In agent environments, this creates unnecessary ambiguity around what the skill may execute or write, increasing the risk of unintended command execution, unsafe file writes, or privilege creep if the skill is invoked with untrusted paths or URLs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very broad natural-language cues like 'listen to this' and 'hear the music,' which can cause the skill to activate in contexts beyond the user's actual intent. In an agent system with shell and file-write capability, overbroad activation increases the chance of unintended processing of local files, URL handling, or execution of helper commands when a simpler response was expected.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_music.py (reported line 17)May include surrounding context.

python

"ffprobe", "-v", "error", "-show_streams", "-show_format",
        "-print_format", "json", str(path)
    ]
    out = subprocess.check_output(cmd, text=True)
    j = json.loads(out)
    astream = next((s for s in j.get("streams", []) if s.get("codec_type") == "audio"), {})
    return {

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/listen.py (reported line 63)May include surrounding context.

python

def run_ffmpeg_to_wav(audio_path: Path, wav_path: Path) -> None:
    cmd = ["ffmpeg", "-y", "-i", str(audio_path), "-ar", "16000", "-ac", "1", str(wav_path)]
    subprocess.run(cmd, check=True, capture_output=True, text=True)


def parse_whisper_stdout(stdout: str) -> list[dict[str, Any]]:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest emphasizes analyzing music/audio features locally and mentions lyric-aware emotional reads only when real Whisper lyrics can override the vibe. In code, a substantial part of the workflow invokes Whisper, extracts timestamped text, stores full transcribed lyrics, and uses them to drive the final emotional interpretation, which goes beyond straightforward audio analysis into transcript generation and text analysis.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/listen.py (reported line 286)May include surrounding context.

python

try:
            run_ffmpeg_to_wav(audio_path, wav_path)
            cmd = [str(WHISPER_CLI), "-m", str(WHISPER_MODEL), "-f", str(wav_path), "-of", str(Path(tmpdir) / "whisper_out")]
            proc = subprocess.run(cmd, check=True, capture_output=True, text=True)
            segments = parse_whisper_stdout(proc.stdout)
            cleaned, clean_notes = clean_lyric_segments(segments)
            full_text = " ".join(seg["text"] for seg in cleaned).strip()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is described as performing local-only analysis without external APIs, but the setup script downloads a large Whisper model from Hugging Face at install time. This creates a supply-chain and trust-boundary issue because installation depends on remote content that may change, be unavailable, or be intercepted in less controlled environments, and it also contradicts the user's likely expectation of fully local setup.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script modifies the user's ~/.zshrc by appending aliases during setup, which changes persistent shell behavior outside the core dependency installation path. Unprompted profile modification is dangerous because it alters the user's environment in a lasting way, can create confusion or command hijacking opportunities later, and exceeds the least-privilege expectations for a setup script.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Appending content to ~/.zshrc without explicit confirmation removes user control over a persistent configuration change. Even though the inserted aliases appear related to the skill, silent shell-profile modification is a risky pattern because similar mechanisms are often abused for persistence, and users may not notice or understand the change.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency list uses an unpinned package name for librosa, which makes builds non-reproducible and allows different environments to resolve to different versions over time. While not an exploit by itself, this increases supply-chain risk because a newly introduced vulnerable or compromised upstream release could be installed without any change to this repository.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

librosa
numpy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency list uses an unpinned package name for numpy, so installations may pull different versions depending on when and where the skill is deployed. This weakens reproducibility and can expose consumers to known vulnerable releases or malicious upstream package changes as part of the software supply chain.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

librosa
numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The manifest includes numpy without a version pin, and numpy has multiple historical advisories; because no version is specified, it is impossible to verify whether the installed release is affected. In this local audio-analysis skill, numpy is foundational rather than directly network-facing, so the contextual risk is somewhat reduced, but uncertain dependency state still creates avoidable supply-chain exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code explicitly formats output as natural English and constructs English-only narrative strings, which enforces a specific language/locale in the skill behavior. The policy allows locale constraints only when user choice or clear justification is provided, neither of which appears in this file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest lists tempo, groove, structure, harmony, timbre, temporal mood-energy journeys, and lyric-aware emotional reads, but it does not claim instrument identification. The implementation imports and runs instrument analysis, then renders an explicit 'INSTRUMENT READ' section in the final report.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The return object in the exception branch sets "available": True while also setting "skipped": True, an error reason, and empty segments. That directly contradicts the documented intent of the lyrics object elsewhere in the file, where availability reflects whether usable lyric content exists.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs a file write when --out is provided, but there is no confirmation prompt, comment/docstring warning, or user-facing message indicating that the file will be created or overwritten. For a code-file review under SQP-2, file writes should have some visible disclosure unless the warning is provided elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-facing comments and runtime messages throughout the script are written exclusively in Chinese, with no indication that another language can be selected. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.