Back to skill

Security audit

Qwen Audio

Security checks across malware telemetry and agentic risk

Overview

This audio skill’s main features fit its purpose, but it can automatically install a prerelease dependency during use and supports voice cloning without consent guidance.

Review before installing. Use an isolated Python or uv environment, expect model and package downloads, and avoid running it where automatic package changes are unacceptable. Only use voice cloning with recordings you own or have explicit permission to use, and treat stored voice profiles as sensitive local data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
import mlx_audio  # noqa: F401
    except ImportError:
        print("mlx-audio 未安装,正在安装...", file=sys.stderr)
        os.system("uv add mlx-audio --prerelease=allow")
        import mlx_audio  # noqa: F401
        print("mlx-audio installed", file=sys.stderr)
    _MLX_AUDIO_READY = True
Confidence
98% confidence
Finding
os.system("uv add mlx-audio --prerelease=allow")

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The skill automatically installs dependencies during execution using a shell command when mlx_audio is missing. In a security-sensitive agent environment, silent dependency installation is dangerous because it performs unreviewed code acquisition and execution, potentially from prerelease sources, and can surprise users or operators who expected a pure local library action.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill explicitly supports voice cloning from reference audio and transcript but provides no warning or safeguards around consent, impersonation, or use of third-party voices. In this context, the capability is inherently sensitive because it enables biometric-style replication of a person's voice, which can facilitate fraud, impersonation, and abuse if used on non-consensual samples.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Automatic package installation occurs without an explicit user-facing confirmation step. Even if the dependency is legitimate, surprise installation changes the host environment and may execute arbitrary install-time code, which is unsafe for an agent skill expected to behave predictably.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.