Galdr

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 0.7.1

Overview

This is a coherent music-analysis skill with disclosed external CLI install and update steps, but no artifact-backed evidence of deception or malicious behavior.

Install only from sources you trust, preferably in a virtual environment or container. Avoid running the install or update commands as an administrator, and be aware that YouTube downloads, lyrics/background lookup, and sending assembled prompts to external models may expose the track or analysis context outside your machine.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Unpinned Installation of Third-Party Runtime Code## Vulnerability Details **File Location**: `SKILL.md`, lines 34–42 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash pip install galdr # or from source: git clone https://github.com/sellemain/galdr.git cd galdr pip install -e . ``` ### Technical Analysis The Skill instructs the operator to install executable Python code from PyPI or clone and install the current state of a remote repository. Neither installation method is pinned to an exact package version, immutable commit, or verified artifact hash. Because the reviewed Skill contains only documentation and metric references, the actual `galdr` runtime implementation is outside the audited artifact. Its effective behavior can consequently change without any modification to this Skill. Although the documented PyPI project and GitHub repository appear consistent with the declared project identity, the instructions do not provide cryptographic integrity verification. This is a supply-chain weakness rather than evidence that the current upstream project is malicious. ### Attack Path 1. An attacker compromises an upstream package, repository, maintainer account, release process, or transitive dependency. 2. The attacker publishes malicious code under the expected package identity or modifies the repository's default branch. 3. An operator follows the Skill's unpinned `pip install` or `git clone` instructions. 4. The mutable remote code is downloaded without verification against a reviewed hash, signature, version, or commit. 5. Malicious installation hooks or subsequently invoked runtime code execute with the permissions of the user running the command. ### Impact Assessment Successful exploitation could execute arbitrary code with the invoking user's privileges. This may permit access to files, environment variables, API credentials, local analysis artifacts, and network resources availa ...[truncated 234 chars]
• Remediation: ## Remediation Suggestions - Pin the PyPI dependency to a reviewed exact version, such as `galdr==X.Y.Z`. - For source installations, check out an immutable reviewed commit or signed release tag before installation. - Publish and verify SHA-256 hashes for approved wheels and source distributions. - Use a lockfile or constraints file that pins transitive dependencies. - Prefer signed releases and document signature-verification procedures. - Install into an isolated virtual environment or container with only the filesystem and network access required for music analysis. - Avoid installing as root or with administrator privileges. - Document a controlled upgrade process that requires review of upstream changes before changing the approved version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:130
• Finding: Uncontrolled Runtime Dependency Upgrade## Vulnerability Details **File Location**: `SKILL.md`, lines 130–134 **Vulnerability Type**: Dynamic upgrade of unpinned runtime dependencies **Risk Level**: Medium **Vulnerable Code**: ```bash if YouTube download behavior is flaky: galdr doctor galdr update-deps ``` The Skill further explains that `galdr update-deps` upgrades `yt-dlp[default,curl-cffi]` in the Python environment used by Galdr. ### Technical Analysis The documented recovery procedure recommends a command that dynamically upgrades executable third-party components. No target versions, approved hashes, signatures, lockfile, or preview-and-confirmation mechanism are specified. The implementation of `galdr update-deps` is not included in the audited artifact, so the precise subprocesses, package indexes, version constraints, and integrity controls used by that command cannot be verified. A troubleshooting operation may therefore alter the runtime environment by retrieving code that was not part of the reviewed Skill. Dependency updates can be legitimate for maintaining compatibility with YouTube, but automatically or indiscriminately upgrading mutable dependencies exceeds the minimum change necessary when a known-good, pinned compatibility set could be used instead. ### Attack Path 1. An attacker compromises an applicable package release, package index account, dependency, or upstream distribution channel. 2. The operator encounters media-download problems and follows the documented troubleshooting instructions. 3. `galdr update-deps` retrieves the currently available dependency versions rather than a reviewed and pinned compatibility set. 4. The compromised package is installed into Galdr's active Python environment. 5. Malicious package installation logic or runtime code executes when installation completes or when Galdr later invokes the dependency. ### Impact Assessment Exploitation could modify the active Python environment and execute ar ...[truncated 510 chars]
• Remediation: ## Remediation Suggestions - Replace broad upgrades with installation of a tested, explicitly versioned compatibility set. - Show the proposed package and version changes before installation and require explicit operator confirmation. - Verify downloaded artifacts using approved hashes or package signatures. - Maintain a lockfile containing all direct and transitive dependencies. - Run diagnostics separately from remediation so `galdr doctor` never causes environmental changes. - Document rollback procedures and preserve the previous working environment. - Perform updates in an isolated virtual environment rather than modifying a shared Python installation. - Require security review before publishing a new approved dependency set.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.