volcengine-lip-sync

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 0.1.3

Overview

This skill is a coherent RunAPI lip-sync workflow, with a supply-chain caution because it installs an unpinned third-party CLI.

Install this only if you trust the RunAPI Homebrew tap and CLI. Expect the skill to use your RunAPI authentication and upload the source media needed for the lip-sync job to the provider service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Unpinned third-party dependency from a mutable Homebrew tap
Risk Level: Medium

Vulnerable Code

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill instructs the environment to install the runapi executable from the third-party Homebrew tap runapi-ai/tap without pinning an audited version, immutable source revision, checksum, or signature.

Because the formula and its referenced artifacts are mutable, the executable installed in a future skill invocation may differ from the version originally reviewed. Compromise of the tap repository, its maintainer account, the release infrastructure, or a referenced binary artifact could cause attacker-controlled code to be installed and executed.

The risk is amplified by the CLI's legitimate access to the RunAPI authentication configuration and user-provided media. No evidence shows that the current dependency is malicious; this finding concerns the absence of controls that bind installation to a reviewed artifact.

Attack Path

1. An attacker compromises the third-party Homebrew tap, a maintainer account, or an artifact distribution endpoint used by its formula.
2. The attacker modifies the formula or replaces a referenced release artifact with a malicious executable.
3. The skill is installed or updated using the mutable formula name runapi-ai/tap/runapi.
4. Homebrew retrieves and installs the attacker-controlled version.
5. The agent invokes runapi as required by the skill.
6. The malicious process executes with the invoking user's privileges and can attempt to access RunAPI credentials, submitted media, generated artifacts, and other resources available to that user.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user installing or running the CLI. The accessible scope may ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific, audited release rather than installing the latest version from a mutable formula.
2. Bind installation to an immutable artifact digest, such as a SHA-256 checksum, and fail closed if verification does not succeed.
3. Verify a trusted publisher signature or provenance attestation before executing the downloaded artifact.
4. Pin or otherwise validate the Homebrew tap revision and review formula changes before upgrades.
5. Document the official artifact source, expected version, checksum, and signer identity in the skill.
6. Perform dependency upgrades through an explicit review process rather than allowing transparent installation of future releases.
7. Run the CLI with least privilege and restrict its access to credentials and media files not required for the current task.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.