虾转音频

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:34 AM UTC
• Version: 1.3.1

Overview

This appears to be a real audio conversion and transcription skill, but it needs review because it can overwrite local files and has an unsafe shared temporary-file pattern.

Review before installing. Use it only on media files and output folders you trust, avoid running it as administrator/root, expect Whisper models to be downloaded unless already cached, and prefer a virtual environment with pinned Python dependencies. The merge temporary-file handling should be fixed before use on shared or multi-user systems.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: audio-forge.js:175
• Finding: Predictable Shared Temporary File Enables Symlink-Based File Overwrite<![CDATA[ ## Vulnerability Details **File Location**: `audio-forge.js`, lines 175-190 **Vulnerability Type**: Insecure temporary-file handling **Risk Level**: Medium ### Vulnerable Code ```js function cmdMerge(files, output) { const listFile = path.join(process.env.TEMP || "/tmp", "xza_merge_list.txt"); console.log(`\n 音频合并`); console.log(` 文件数量: ${files.length}`); const content = files.map(f => `file '${f.replace(/\\/g, "/")}'`).join("\n"); fs.writeFileSync(listFile, content, "utf8"); const args = [ "-f", "concat", "-safe", "0", "-i", `"${listFile}"`, "-c", "copy", `"${output}"` ]; runFFmpeg(args); fs.unlinkSync(listFile); console.log(`\n 合并完成: ${output}`); } ``` ### Technical Analysis Every merge operation uses the same predictable temporary path: `/tmp/xza_merge_list.txt` on Unix-like systems, or the equivalent path beneath the directory specified by `TEMP`. `fs.writeFileSync()` follows symbolic links and opens an existing file for truncation by default. It does not use exclusive creation, verify that the destination is a regular file, or ensure that the file was created inside a private temporary directory. Consequently, another local process can prepare the predictable path as a symbolic link to a file writable by the user running this Skill. The shared filename also creates a race between concurrent Skill invocations. One process can replace, modify, or delete another process's FFmpeg concat list. This is particularly problematic because `runFFmpeg()` starts FFmpeg asynchronously and returns immediately, after which `cmdMerge()` immediately deletes the list file. Although this latter behavior is primarily a reliability defect, it increases the opportunity for race conditions and input manipulation. ### Attack Path 1. The attacker has local access to the same system and can write to the shared temporary directory. 2. The attacker predicts that the Skill will use `/tmp/xza_merge_list.txt`. 3. Before the ...[truncated 1421 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a unique, private temporary directory for each merge operation and create the list file exclusively: ```js const os = require("os"); const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), "xza-merge-")); const listFile = path.join(tempDir, "inputs.txt"); try { fs.writeFileSync(listFile, content, { encoding: "utf8", flag: "wx", mode: 0o600 }); await runFFmpeg(args); } finally { fs.rmSync(tempDir, { recursive: true, force: true }); } ``` Additional hardening should include: 1. Change `runFFmpeg()` to return a Promise and wait for the child process to exit before deleting the list file. 2. Reject symbolic links if an existing path is ever accepted. 3. Restrict temporary-file permissions to the current user. 4. Avoid a globally shared filename. 5. Validate and correctly escape filenames written to FFmpeg concat-list syntax, including embedded single quotes and line breaks. 6. Avoid running the Skill with elevated privileges. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:54
• Finding: Unpinned Python Dependency Creates Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-58 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code ```markdown - **Python** — 系统已有（用于音频转文字） - **faster-whisper** — 运行 `pip install faster-whisper` 安装 ### Whisper 模型安全说明 ``` The documented installation command is: ```bash pip install faster-whisper ``` ### Technical Analysis The Skill instructs users to install `faster-whisper` without specifying a reviewed version, dependency lockfile, or integrity hashes. Pip will therefore resolve the latest available release and its transitive dependencies at installation time. This makes installation non-reproducible: the code that executes in a future installation can differ from the code available when the Skill was audited. Python package installation may execute package build logic, while imported dependencies execute with the permissions of the user running `transcribe.py`. The project contains no Python requirements lockfile or hash-pinned dependency manifest. The `package.json` file also does not manage this Python dependency. No evidence was found that the current package name is intentionally malicious or typosquatted. The issue is the absence of version and integrity controls, rather than proof that the present upstream package is compromised. ### Attack Path 1. A user follows the installation instructions and runs: ```bash pip install faster-whisper ``` 2. Pip resolves the latest available package and transitive dependency versions from its configured package index. 3. If a future upstream release, transitive dependency, configured mirror, or user package-index configuration is compromised, pip downloads the affected artifact. 4. Installation-time build logic or subsequent imports execute attacker-controlled code with the installing user's privileges. 5. The compromised dependency can access data and resources available to that user, including media files supplied for tr ...[truncated 977 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a reviewed, version-pinned dependency manifest, for example: ```text faster-whisper==<reviewed-version> ``` 2. Lock all transitive dependencies rather than pinning only the top-level package. 3. Generate and verify cryptographic hashes, then install using: ```bash pip install --require-hashes -r requirements.txt ``` 4. Regenerate the lockfile through a controlled review and update process. 5. Install dependencies inside a dedicated virtual environment. 6. Use a trusted package index and explicitly document the expected source. 7. Avoid installing the package as root or with administrator privileges. 8. Consider distributing a verified environment manifest or signed release artifacts for reproducible deployment. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 该描述与代码部分匹配：代码确实支持格式转换、视频提取音频、合并、分割、压缩和信息查看。但存在实质性描述偏差。首先，最明显的是声明包含“音频转文字”，而代码完全没有对应命令或实现，虽然注释里提到脚本目录可能包含 transcribe.py 和 um.exe，但二者均未被调用。其次，描述称基于“FFmpeg + Whisper AI”，实际代码只依赖并调用 FFmpeg/FFprobe。最后，描述表述为较宽泛的“音视频格式转换与处理工具箱”，而该代码实际是音频处理 CLI，只涉及从视频抽取音频，不提供视频转换、剪辑、压缩或视频信息查看等更广义的视频处理能力。因此应判定为描述与实际行为不完全一致，属于 mismatch。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises shell execution, file read/write, and environment-variable usage but does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this increases the risk of over-broad execution, unexpected file modification, or command invocation without users understanding the privilege level.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation omits clear warnings that the skill may write output files, potentially overwrite existing data, and download Whisper models from remote sources. This reduces informed consent and can expose users to unintended data loss, bandwidth consumption, or external network access in environments where such actions are sensitive.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The natural-language trigger examples are broad and overlap with ordinary conversation, which can cause accidental invocation of shell-backed file-processing actions. In a skill that can read inputs, write outputs, and invoke external tools, misfires can lead to unintended media processing, file creation, or overwriting.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest description explicitly includes '音频转文字' and references Whisper AI, but the executable command set in this file only supports convert, extract, merge, split, compress, and info. Although comments mention transcribe.py in the script directory, there is no transcription command or Whisper invocation anywhere in the implemented CLI.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Natural-language strings throughout the file, including the banner and CLI help, are presented only in Chinese, with no mechanism for language selection or opt-in. This creates a locale policy issue because the skill imposes a specific language on all users rather than offering a choice.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This code file contains user-facing natural language that fixes the interaction language to Chinese, beginning with the title and continuing throughout prompts and menu text. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The tool performs implicit network access to Hugging Face to download models at runtime, but this capability is not clearly disclosed in the skill description and may violate user or platform expectations about offline/local processing. Undisclosed outbound connectivity expands the trust boundary, can leak usage metadata such as IP/addressing and model requests, and introduces supply-chain and availability risk if remote content changes or is unavailable.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
    print(f"  从视频提取音频...")
    try:
        subprocess.run(cmd, capture_output=True, check=True)
    except subprocess.CalledProcessError as e:
        print(f"[错误] 提取音频失败: {e.stderr.decode('utf-8', errors='replace')}")
        sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: 文件的描述、功能说明和使用示例均以中文呈现，未说明是否支持其他语言或允许用户选择展示语言。按照语言/区域策略，若技能强制单一语言而无用户选择，可能构成自然语言层面的策略问题。

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The header comment says automatic discovery checks environment variables, system PATH, and then 'winget 安装的路径'. In practice, findFFmpeg only checks the environment variable and runs 'where ffmpeg'; there is no code for a winget-specific fallback, so the documentation contradicts actual behavior.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The merge operation writes a predictable temporary file (`xza_merge_list.txt`) into a shared temp directory and later deletes it without safeguards. On multi-user systems or hostile local environments, another process could race to read, replace, or symlink that file, potentially altering merge inputs or causing unintended file deletion.

Description-Behavior Mismatch

Low

• Confidence: 83% confidence
• Finding: The manifest says the skill supports '音频转文字' (audio to text), which naturally covers transcription but does not clearly claim translation. The code exposes a '--task' option with 'translate', allowing conversion of speech into English rather than just transcription of the original speech.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: audio-forge.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: menu.js:71