Qwen3 Audio

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 0.1.1

Overview

This audio skill mostly matches its stated purpose, but it can automatically install external prerelease code during normal use and stores sensitive voice/transcript artifacts with limited safeguards.

Review before installing. Prefer creating the uv environment yourself and preinstalling a pinned `mlx-audio` version instead of relying on the script's automatic install path. Only clone voices you are authorized to use, and treat saved `voices/` profiles, transcripts, subtitles, and generated audio as sensitive local files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

import mlx_audio  # noqa: F401
    except ImportError:
        print("✗ mlx-audio 未安装，正在安装...", file=sys.stderr)
        os.system("uv add mlx-audio --prerelease=allow")
        import mlx_audio  # noqa: F401
        print("✓ mlx-audio 安装完成", file=sys.stderr)
    _MLX_AUDIO_READY = True

• Confidence: 98% confidence
• Finding: os.system("uv add mlx-audio --prerelease=allow")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises shell, file, environment, and network-capable behavior but does not declare any permissions or trust boundaries. That creates a real security and governance gap because an agent or reviewer may authorize the skill under incomplete assumptions, while the documented commands can read/write local files, invoke executables, and potentially fetch models or resources over the network.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented behavior goes beyond the high-level description by including persistent voice-profile storage, subtitle/export generation, and likely model/network setup behavior. This is dangerous because users may approve what appears to be a simple TTS/STT skill without realizing it stores biometric-related artifacts and may perform broader system and network actions than expected.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: For an audio TTS/STT skill, automatically executing a package-manager shell command at runtime is outside the safe minimum needed for core functionality. It expands the attack surface to dependency confusion, compromised package sources, and unintended environment mutation whenever the import fails.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Voice cloning and saved voice profiles involve biometric-like voice data and associated transcripts/instructions, yet the skill provides no explicit warning about consent, impersonation risk, retention, or misuse. In this context, the feature is inherently more sensitive because it enables reusable cloned voices stored on disk, which can facilitate unauthorized impersonation or privacy violations if created from third-party samples.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The STT feature writes transcripts and subtitle files to disk without warning that spoken content may contain secrets, personal data, or regulated information. This is risky because transcripts are more searchable and easier to exfiltrate than audio, and generating multiple output formats increases the number of persistent sensitive artifacts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script runs a package-management command automatically, without a separate confirmation boundary, when mlx-audio is missing. That means simply invoking the skill can trigger installation of external code and modify the user's environment unexpectedly, which is especially risky in automation or privileged contexts.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.