Security audit

Byted Las Audio Convert

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform the advertised Volcengine audio conversion, but it automatically installs a remote SDK package without pinned verification and handles cloud credentials, so it should be reviewed before installation.

Install only if you are comfortable letting the skill create or reuse a Python virtual environment and install a Volcengine LAS SDK wheel from the network. Use narrowly scoped or temporary LAS/TOS credentials, avoid broad long-lived keys when possible, review or pin the SDK package before use, and keep the required price-confirmation pause before uploading or converting files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:27
Finding: Mandatory Final-Response Content Hijacking
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/env_init.sh:31
Finding: Installation of an Unverified Mutable Remote Package
Content: View full analysis
/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0") remote_ver=$(echo "$manifest" | jq -r '.sdk_version // "unknown"') if [ "$local_ver" = "0.0.0" ] || [ "$local_ver" != "$remote_ver" ]; then echo "📦 SDK 更新: $local_ver → $remote_ver，正在安装..." pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl fi ``` The comments and status message identify the operations as retrieving a remote manifest, comparing the SDK version, and installing an SDK update. ### Technical Analysis The mandatory initialization script downloads a mutable manifest and installs a Python wheel directly from an external URL. The wheel is not authenticated using a pinned cryptographic digest, trusted package signature, or locally maintained lock file. HTTPS protects the network connection in transit, but it does not protect against compromise of the hosting account, storage bucket, release pipeline, or the package object at the referenced URL. Because the URL is not bound to a verified digest, the effective package contents can change after the skill has been reviewed. `pip install` processes package metadata and installs executable Python modules and command-line entry points into the active virtual environment. A malicious replacement wheel could therefore change `lasutil`, install additional modules, or execute package build or installation behavior under the privileges of the user running the ...[truncated 2328 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as an audio conversion utility, but the documented behavior also includes environment bootstrapping, SDK/package updates, manifest download, and remote network activity unrelated to the core user-visible function. This mismatch is dangerous because it hides additional execution and supply-chain exposure behind an innocuous description, preventing informed consent and weakening review of what the skill actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as an audio conversion utility, but the documented behavior also includes environment bootstrapping, SDK/package updates, manifest download, and remote network activity unrelated to the core user-visible function. This mismatch is dangerous because it hides additional execution and supply-chain exposure behind an innocuous description, preventing informed consent and weakening review of what the skill actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes shell commands extensively (source, ffprobe, lasutil, jq, helper scripts) but does not declare an explicit tool scope or allowed-tools boundary. That creates an authorization gap: a host agent may grant broader shell capability than users expect, increasing the chance of unintended command execution or abuse through this skill's workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction requires the final reply to include a fixed Chinese disclaimer, which imposes a specific language on the user-facing response. This is a natural-language policy concern because the skill does not offer a language choice or explain a justified locale restriction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill requests additional long-lived cloud credentials (VOLCENGINE_ACCESS_KEY and VOLCENGINE_SECRET_KEY) for downloading results back to local storage, expanding privilege beyond the stated conversion task. Requesting broader credentials than necessary increases secret exposure risk and can enable unintended access to cloud storage if the skill, environment, or logs are compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON file contains natural-language prompts and expected outputs entirely in Chinese, which implicitly constrains the skill's usage and evaluation to a specific language. Under the policy, language-specific behavior should either offer user opt-in/choice or clearly document a justified locale constraint; neither is present in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's user-facing comments and runtime messages are presented in Chinese only, including usage and error/status output. This imposes a specific language on users without opt-in or explanation, which matches the stated language/locale policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script fetches a remote manifest and then conditionally installs a Python wheel directly from a network URL during environment initialization. This creates a supply-chain and remote-code-execution risk because whoever controls the remote endpoint or the delivery path can influence what code gets installed, and the behavior is unrelated to core local audio conversion needs of the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script silently downloads metadata and installs a package from a remote URL with only progress output, so users may trigger code download and execution without understanding the side effect. Lack of explicit warning and confirmation increases the chance of unreviewed dependency changes and makes a compromised remote source more dangerous.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest says the skill supports both TOS cloud storage paths and local file upload, but the top-level SKILL.md description states only that it converts audio files on TOS. Although later workflow steps do discuss uploading local files, the primary documented behavior at L009 understates the advertised scope and can mislead about actual supported inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: 该 API 参考文档的标题、说明和字段描述均仅以中文呈现，未说明这是面向特定中文用户群体的区域性文档，也未提供其他语言选项。根据规则，强制特定语言而缺少用户选择或明确合理说明，属于自然语言层面的潜在政策问题。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This shell script emits user-facing comments and error/status messages in Chinese only, such as the header and echo statements. The policy scope allows flagging language or locale constraints when the skill forces a specific language without user opt-in, and this file provides no alternative language selection or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The script creates a new directory under /tmp and exports it as LAS_WORKDIR, which is a filesystem side effect. While the final echo shows the created directory, the usage/comment header does not warn users in advance that sourcing the script will create local files/directories.
Content: No source excerpt is available for this finding.