Audio Quality Checker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 1.0.2

Overview

This skill does what it says, but it can upload sensitive audio recordings to SenseAudio without a clear per-upload consent step.

Review this skill before installing if your recordings may contain private conversations, customer data, regulated information, or voice biometrics. Only use it on files you intentionally choose to send to SenseAudio, confirm the provider's retention and privacy terms, and avoid enabling microphone-recording workflows unless they add clear permission prompts and recording limits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:25

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

Vulnerable Code

markdown

## Prerequisites

Install required Python packages:

```bash
pip install requests

text

### Technical Analysis

The installation command resolves and installs the latest version of `requests` and its transitive dependencies available from the configured Python package index. It provides no version constraint, lock file, package hash, or repository restriction.

Although `requests` is a legitimate package and the audited Skill does not intentionally retrieve a malicious dependency, this installation process is not reproducible. A future compromised release, compromised package index, malicious index configuration, or unsafe transitive dependency could cause code that was not reviewed with the Skill to enter the execution environment.

### Attack Path

1. An attacker compromises a future dependency release, a transitive dependency, or a package source used by the environment.
2. A user follows the documented `pip install requests` instruction without a lock file or integrity verification.
3. Package resolution selects the affected release.
4. The unreviewed package is installed and later imported by the Skill.
5. Malicious package code executes with the privileges of the Python process.

This path depends on compromise or manipulation of the dependency supply chain; no such compromise is present in the audited project.

### Impact Assessment

A malicious dependency could read files and environment variables accessible to the process, including `SENSEAUDIO_API_KEY`, modify application data, or make network requests. It would execute with the invoking user's privileges. The Skill itself does not request elevated operating-system privileges, so the direct scope is limited to resources available to that user or runtime.

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions in a lock file.
• Use hash verification, such as pip install --require-hashes -r requirements.txt.
• Configure installation to use a trusted, explicitly selected package index.
• Install dependencies inside an isolated virtual environment with minimum filesystem and network permissions.
• Use automated dependency vulnerability and integrity scanning.
• Establish a controlled update process so dependency changes are reviewed before deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:38

Finding

Sensitive Audio Is Uploaded Without Explicit Consent or Transfer Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-47
Vulnerability Type: Unprotected disclosure of potentially sensitive audio to a third-party service
Risk Level: Medium

Vulnerable Code

python

API_KEY = os.environ["SENSEAUDIO_API_KEY"]

def check_audio_quality(audio_file):
    url = "https://api.senseaudio.cn/v1/audio/analysis"

    headers = {"Authorization": f"Bearer {API_KEY}"}
    files = {"file": open(audio_file, "rb")}
    data = {"model": "sense-asr-check"}

    response = requests.post(url, headers=headers, files=files, data=data)
    return response.json()

Technical Analysis

The function reads the complete file identified by audio_file and uploads it to https://api.senseaudio.cn/v1/audio/analysis. This external transfer is disclosed by the Skill and is necessary for its declared cloud-based audio-analysis functionality; it is not covert exfiltration. Nevertheless, audio can contain private conversations, biometric voice characteristics, credentials, or other confidential information.

The documented workflow does not require explicit user approval immediately before upload, display the destination and selected file, restrict paths to files deliberately selected by the user, impose file size or media-type limits, or describe the service's retention and privacy handling. An agent acting on an ambiguous request could therefore upload a recording the user did not intend to disclose.

The file is also opened without a context manager, so its descriptor may remain open until garbage collection. The request has no timeout and does not call raise_for_status(), allowing an unavailable endpoint to block execution or an HTTP error body to be treated as a normal analysis response.

The API key is transmitted in an HTTPS authorization header to the declared API endpoint. No hardcoded credential or intentional transmission of the key to an unrelated destination was found.

At

...[truncated 1372 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed approval immediately before each upload. Show the exact file, destination domain, and purpose of the transfer.
• Clearly document the external service's privacy, retention, deletion, and data-processing terms.
• Restrict uploads to files explicitly selected or attached by the user; reject arbitrary or out-of-scope filesystem paths.
• Validate file type, extension, size, and audio structure before transmission.
• Open the file with a context manager so it is closed deterministically.
• Configure connection and read timeouts and validate HTTP status before parsing JSON.
• Handle invalid JSON and sanitized API errors without exposing authorization headers or other secrets.
• Consider local analysis or redaction where recordings may contain confidential material.

Example hardening pattern:

python

def check_audio_quality(audio_file):
    url = "https://api.senseaudio.cn/v1/audio/analysis"
    headers = {"Authorization": f"Bearer {API_KEY}"}
    data = {"model": "sense-asr-check"}

    validate_user_selected_audio(audio_file)

    with open(audio_file, "rb") as audio:
        response = requests.post(
            url,
            headers=headers,
            files={"file": audio},
            data=data,
            timeout=(5, 120),
        )

    response.raise_for_status()
    return response.json()

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documentation does not clearly warn that audio files are uploaded to an external third-party API for analysis. Audio often contains sensitive personal, business, or regulated information, so silent transmission to an external vendor creates a significant privacy and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description uses broad trigger language such as 'use when users need to check audio quality, validate recordings, or identify audio problems,' which can cause the agent to invoke the skill in situations where users may not realize audio will be handled by an external service. Ambiguous activation increases the chance of unintended processing of sensitive recordings.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The code uploads the local audio file to https://api.senseaudio.cn/v1/audio/analysis, which is an external transmission of potentially sensitive content. While this is core to the skill's function, it remains a real security/privacy concern because recordings may include confidential or personal information and the code provides no consent, minimization, or error-handling safeguards around that transfer.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

API_KEY = os.environ["SENSEAUDIO_API_KEY"]

def check_audio_quality(audio_file):
    url = "https://api.senseaudio.cn/v1/audio/analysis"

    headers = {"Authorization": f"Bearer {API_KEY}"}
    files = {"file": open(audio_file, "rb")}

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes a workflow that records new audio via a placeholder function instead of limiting itself to analyzing an existing user-provided file. That expands the capability from passive analysis to active data collection, which can capture sensitive microphone input unexpectedly if implemented by downstream users without explicit consent and clear UX boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.