Security audit

Byted Las Audio Extract And Split

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform the advertised Volcengine LAS audio processing, but it needs review because its setup can automatically download and install remote SDK code.

Install only if you are comfortable sending the chosen media to Volcengine LAS/TOS and allowing the setup script to download and install SDK code. Use least-privilege, temporary credentials, avoid storing long-lived keys in project files, and consider reviewing or pinning the SDK dependency before running the initializer.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands extensively (`source`, `ffprobe`, `lasutil`, `jq`, helper scripts) but does not declare shell/code-execution capability. This creates a transparency and policy-enforcement gap: a host may treat the skill as low-privilege while it can actually execute arbitrary local commands and access the runtime environment.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is audio extraction/splitting, but the workflow also performs remote SDK updates, virtualenv creation, remote manifest/operator checks, and report generation. This mismatch is dangerous because users and policy engines may consent to a simple media task without realizing the skill reaches out to remote services, installs software, and changes the local environment.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill description focuses on media processing, but the workflow uploads local user files to Volcengine TOS and stores outputs remotely. This is a material data-handling behavior that affects confidentiality and compliance, especially for sensitive audio/video, and users may not expect their files to leave the local environment.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill asks the agent to access cloud credentials (`LAS_API_KEY`, and sometimes `VOLCENGINE_ACCESS_KEY` / `VOLCENGINE_SECRET_KEY`) and perform cloud storage operations beyond the narrow media-processing claim. Handling additional credentials and storage actions increases the blast radius: leaked or misused keys could expose buckets, enable unauthorized object access, or broaden cloud account compromise.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The environment initialization script fetches a remote manifest and conditionally installs software from the network during setup, which expands the skill's trust boundary far beyond local audio processing. Even if intended for SDK maintenance, this creates a supply-chain risk: a compromised remote endpoint, manifest, or wheel URL could cause arbitrary code to be installed and executed in the user's environment.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The script automatically upgrades and installs a Python wheel directly from a remote URL at runtime. This is dangerous because it enables remote code introduction into the execution environment without integrity verification, making compromise of the hosting location or network path a direct route to code execution.

Static analysis

No suspicious patterns detected.