Security audit

虾转音频

Security checks across malware telemetry and agentic risk

Overview

This skill performs local audio/video conversion and transcription as advertised, with disclosed FFmpeg use and Whisper model downloads.

Install only if you are comfortable running local FFmpeg/Python tools on files you choose. Use explicit output paths, keep originals backed up, and expect first transcription use to download and cache a Whisper model from HuggingFace or the configured mirror.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises capabilities that imply shell execution, environment access, and file read/write behavior, but it does not declare permissions or operational boundaries. That creates a transparency and consent problem: an invoking agent or user may not realize the skill can access local files, spawn FFmpeg/Python processes, or use environment-provided paths, increasing the chance of unsafe execution or abuse.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script explicitly states that it will automatically download Whisper models on first run, but this network behavior is not disclosed in the skill metadata. Undeclared external downloads matter in agent environments because they expand trust boundaries, may violate sandbox or policy expectations, and can expose usage metadata or fail unpredictably in restricted environments.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: Constructing WhisperModel with download_root and a remote model name enables automatic retrieval from Hugging Face when the model is absent locally, creating an undeclared outbound network capability. In an agent skill, hidden network access is security-relevant because it can bypass operator expectations, introduce supply-chain exposure, and leak environment-level metadata such as IP address and timing.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad, everyday requests such as converting audio or extracting sound, without requiring explicit invocation or confirmation. In agent environments, that can cause overbroad auto-activation on unrelated user messages, leading to unintended file operations, command execution, or processing of sensitive media.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The documentation mentions downloading Whisper models from HuggingFace or a mirror but does not clearly warn users that network access occurs and may disclose metadata such as IP address, requested model, and mirror usage. In privacy-sensitive settings, users may assume transcription is fully local and be surprised by outbound connections during model retrieval.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: audio-forge.js:28

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: menu.js:71