Security audit

ai-audio-generation

Security checks for vulnerabilities and agentic risk

Overview

The audio workflow is coherent, but its feedback instructions can send private task details without your review.

Review and redact feedback before sending it, especially commands containing private prompts or diagnostic results. Use reviewed, pinned package and skill revisions, isolate installation state, and set a spending limit. Treat hosted audio links as accessible to anyone who obtains them. This review inspected all supplied artifact content, but did not verify the downloaded CLI or hosted service implementation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied chunk is a skill-installation command, not an audio-generation implementation. It visibly performs no signup, prompt submission, audio retrieval, job lookup, or receipt handling. Installation could be a prerequisite for another implementation, but the supplied code's only demonstrated behavior is an undeclared global agent-skill installation. The contents and behavior of the downloaded skill cannot be established from this command alone.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The visible code's sole operational action is updating the skill, rather than generating audio. Although updating could support a larger implementation, this chunk does not show that connection or any declared audio workflow. The assessment is limited to the supplied code; the behavior of the invoked CLI and any updated content is not visible.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The guide command executes luxin-cli@latest, so its executable contents can change without changes to this skill. A compromised upstream release could execute code with the agent's permissions; describing the command as no-spend does not restrict its local execution privileges. This is an npm CLI supply-chain risk, not an MCP-specific issue.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The main generation command executes the mutable luxin-cli@latest release rather than a reviewed fixed version. Upstream compromise could expose local files or credentials through code running with the agent's permissions; the media spending limit does not mitigate that risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The installation command invokes an unversioned skills npm package and installs skill content from a repository without an immutable revision. A compromised installer or changed repository could introduce executable code or persistent agent instructions, with the global installation increasing the scope beyond the current task.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The alternative installation command also executes an unpinned npm installer and retrieves mutable repository content for a global agent skill. Although installation is clearly disclosed, upstream compromise could affect subsequent agent sessions through the installed instructions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The writable-home workaround repeats the unpinned installer and mutable repository installation. Redirecting HOME changes the installation destination but does not sandbox the process or prevent a compromised package from accessing other resources available to the agent.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y luxin-cli'.

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Fetching guidance runs luxin-cli@latest as executable code, so even consulting documentation depends on a mutable upstream release. A compromised release could execute locally and supply malicious follow-on guidance; matching documentation to the installed version does not establish its trustworthiness.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The update command invokes an unpinned skills package and can replace installed agent instructions with newly retrieved content. The explicit-update requirement reduces silent modification risk, but LUXIN_SKILL_REVISION is a comparison marker rather than a cryptographic pin or integrity check.
Content: No source excerpt is available for this finding.

The feedback workflow sends task details to a hosted service without a privacy warning or review step.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The fallback instructions direct the agent to submit the attempted command, expected behavior, and actual behavior to hosted feedback without a redaction or approval step. Commands and diagnostic output may contain confidential prompts, paths, tokens, or internal service details, creating a disclosure channel beyond the data needed for audio generation. The actual payload and service handling are not visible here.
Content: No source excerpt is available for this finding.