Security audit

Audio Processor

Security checks for vulnerabilities and agentic risk

Overview

This is a normal local audio-processing skill, with predictable file-write and dependency hygiene risks but no evidence of hidden or malicious behavior.

Install only if you are comfortable letting it read local audio files and write processed outputs. Use a dedicated working folder, avoid pointing outputs at important existing files, and consider pinning dependencies or using a lockfile in stricter environments.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydub>=0.25.1 librosa>=0.10.0 soundfile>=0.12.1 mutagen>=1.47.0
Confidence: 93% confidence
Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed. This increases supply-chain risk and can unexpectedly introduce breaking changes or newly vulnerable releases into the skill environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydub>=0.25.1 librosa>=0.10.0 soundfile>=0.12.1 mutagen>=1.47.0 numpy>=1.24.0
Confidence: 93% confidence
Finding: Using an unpinned version for librosa permits installation of any later release, including versions not tested with this skill. That creates a software supply-chain exposure where upstream compromise or a bad release could affect builds reproducibly.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydub>=0.25.1 librosa>=0.10.0 soundfile>=0.12.1 mutagen>=1.47.0 numpy>=1.24.0 matplotlib>=3.7.0
Confidence: 93% confidence
Finding: The soundfile package is not pinned to an exact version, so installations may drift over time. This can pull in vulnerable or incompatible releases and weakens build reproducibility.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pydub>=0.25.1 librosa>=0.10.0 soundfile>=0.12.1 mutagen>=1.47.0 numpy>=1.24.0 matplotlib>=3.7.0 noisereduce>=3.0.0
Confidence: 93% confidence
Finding: An unpinned mutagen dependency allows the environment to resolve to newer versions without explicit review. That creates avoidable supply-chain and stability risk, especially in automated builds.

Unpinned Dependencies

Low

Category: Supply Chain
Content: librosa>=0.10.0 soundfile>=0.12.1 mutagen>=1.47.0 numpy>=1.24.0 matplotlib>=3.7.0 noisereduce>=3.0.0 scipy>=1.10.0
Confidence: 95% confidence
Finding: The numpy dependency is unpinned, so the build may resolve to different versions over time, including vulnerable ones. Because numpy is a widely used native-code package central to audio/data processing, version drift can have broader reliability and security consequences than a minor utility package.

Unpinned Dependencies

Low

Category: Supply Chain
Content: soundfile>=0.12.1 mutagen>=1.47.0 numpy>=1.24.0 matplotlib>=3.7.0 noisereduce>=3.0.0 scipy>=1.10.0 ffmpeg-python>=0.2.0
Confidence: 93% confidence
Finding: matplotlib is specified with only a minimum version, allowing uncontrolled upgrades. This weakens reproducibility and can introduce vulnerable or incompatible releases into the runtime.

Unpinned Dependencies

Low

Category: Supply Chain
Content: mutagen>=1.47.0 numpy>=1.24.0 matplotlib>=3.7.0 noisereduce>=3.0.0 scipy>=1.10.0 ffmpeg-python>=0.2.0
Confidence: 93% confidence
Finding: The noisereduce package is unpinned, permitting installation of arbitrary newer versions. That exposes the skill to supply-chain risk and untested behavior changes.

Unpinned Dependencies

Low

Category: Supply Chain
Content: numpy>=1.24.0 matplotlib>=3.7.0 noisereduce>=3.0.0 scipy>=1.10.0 ffmpeg-python>=0.2.0
Confidence: 95% confidence
Finding: scipy is a core scientific package with compiled components, and leaving it unpinned allows unreviewed versions to be installed. For an audio-processing skill, this increases the chance of pulling in a vulnerable or unstable release affecting core functionality.

Unpinned Dependencies

Low

Category: Supply Chain
Content: matplotlib>=3.7.0 noisereduce>=3.0.0 scipy>=1.10.0 ffmpeg-python>=0.2.0
Confidence: 94% confidence
Finding: ffmpeg-python is unpinned, so later releases may be installed automatically without review. In an audio-processing skill that likely interfaces with external media tooling, that can increase supply-chain risk and expose parsing/conversion workflows to unstable or insecure changes.

Static analysis

No suspicious patterns detected.