Security audit

音频生成工具-专业版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an audio-generation wrapper, but its activation scope is broader than its stated purpose while allowing command execution, file writes, API credentials, and voice-sample uploads.

Review this skill before installing if you only need narrow audio generation. It requires a third-party CLI and API key and may upload voice samples to external services for cloning; use it only for authorized audio content and avoid letting it handle generic video, media conversion, or unrelated file-processing tasks.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger condition is extremely broad ('需要视频处理、音频编辑、媒体转换、配音生成时使用'), so the skill may activate for many unrelated or only partially related user requests. Because this skill exposes read/exec/write-capable workflows and external CLI usage, over-triggering can cause inappropriate tool selection and unintended command execution paths in contexts where safer, narrower skills should have been used.

Static analysis

No suspicious patterns detected.