Hum2Song

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:48 AM UTC
• Version: 3.0.4

Overview

Hum2Song is a coherent local audio-to-song skill with expected file outputs and dependency setup, though users should install it in an isolated environment.

Install dependencies in a dedicated virtual environment or container, review or pin third-party packages before use, and choose an output path carefully because existing files may be overwritten. Enable ACE-Step only if you accept the local model download and its additional dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Packages and Mutable Repository Dependency

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:43
• SKILL.md:53-54
• references/ace-step.md:13-15
• references/basic-pitch.md:14
• references/librosa.md:15
• references/pretty_midi.md:16

Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:43:

bash

pip install basic-pitch pretty_midi librosa soundfile numpy

SKILL.md:53-54:

bash

git clone https://github.com/ace-step/ace-step.git
pip install -r ace-step/requirements.txt

references/ace-step.md:13-15:

bash

git clone https://github.com/ace-step/ace-step.git
cd ace-step
pip install -r requirements.txt

references/basic-pitch.md:14:

bash

pip install basic-pitch

references/librosa.md:15:

bash

pip install librosa

references/pretty_midi.md:16:

bash

pip install pretty_midi

Technical Analysis

The installation instructions do not pin Python packages to reviewed versions, validate package hashes, or pin ACE-Step to an immutable commit. Consequently, executing these commands installs whatever versions are currently selected by the package index and the current contents of the repository's default branch.

Python packages and source repositories can execute code during installation and later when imported. The ACE-Step repository is especially mutable because git clone retrieves the latest default-branch revision rather than a reviewed commit or signed release. Its unpinned requirements.txt can introduce additional mutable transitive dependencies.

This does not establish that any current upstream component is malicious. The weakness is that the effective installed code can change after this Skill has been audited, leaving users exposed to upstream account compromise, malicious releases, dependency confusion, or compromised transitive dependencies.

Attack Path

1. An attacker compromises an upstream package, one of its transitive dependencies, the ACE-Step rep ...[truncated 1245 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version, for example through a locked requirements file.
2. Generate hashes for all distributions and install with hash verification:

bash

python -m pip install --require-hashes -r requirements.lock

3. Pin ACE-Step to an immutable, reviewed commit rather than the mutable default branch:

bash

git clone https://github.com/ace-step/ace-step.git
cd ace-step
git checkout <reviewed-full-commit-hash>

4. Verify the selected commit or release using upstream signatures or independently published checksums where available.
5. Lock and audit all transitive requirements used by ACE-Step rather than installing an unconstrained upstream requirements.txt.
6. Install dependencies inside a dedicated virtual environment or container under a non-privileged account.
7. Integrate dependency vulnerability and provenance scanning into release review.
8. Periodically update pins through an explicit review process instead of resolving the latest dependency versions during installation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill demonstrates file-writing behavior such as saving MIDI and audio outputs, but it does not declare any explicit tool scope or permissions. This creates a mismatch between documented capabilities and allowed operations, which can lead to overbroad execution in an agent environment and makes it harder to enforce least-privilege controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md

Use this skill when the user:
- Hums or sings a melody and wants to turn it into a full song
- Has an audio recording of humming/singing
- Wants to create music from their own melodic ideas
- Asks to "turn my humming into a song"

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

brew install ffmpeg fluidsynth

# Ubuntu/Debian
sudo apt-get install ffmpeg fluidsynth

# Python packages
pip install basic-pitch pretty_midi librosa soundfile numpy

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code performs file writes for generated audio, and later may also copy MIDI data to a user-visible location. Although the script prints progress and saved paths, it does not warn the user that it will create or replace files at the specified output path or default Music directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.