Byted Las Long Video Understand

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 1.0.1

Overview

The skill’s cloud audio-processing purpose is coherent, but its setup script can automatically fetch and install remote SDK code without a clear consent or integrity check.

Review env_init.sh before installing. Use an isolated environment, avoid long-lived credentials, prefer least-privilege LAS/TOS keys, confirm pricing before any upload, and only proceed if you are comfortable with the skill sending selected media to Volcengine and installing SDK code from the remote Volcengine-hosted URL.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill invokes shell commands (`source`, `ffprobe`, `lasutil`, helper scripts) but does not declare shell/code-execution permissions. This creates a hidden capability gap: a caller or reviewer may believe the skill is limited to simple media processing while it can execute local commands, access environment variables, and interact with the filesystem and network through scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is audio extraction/splitting, but the workflow also performs remote update/install behavior, virtualenv creation, manifest fetching, and other side effects not clearly reflected in the declared scope. Auto-installing or upgrading code from a remote source at runtime materially increases supply-chain risk and can lead to unexpected code execution, especially because the skill also handles API keys and local files.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The environment initialization script reaches out to a remote manifest and conditionally updates SDK code at runtime, which is outside the narrowly described audio extraction/splitting behavior. This creates a supply-chain risk: a compromised manifest endpoint, wheel URL, or network path could cause unreviewed code to be installed and executed whenever the skill is initialized.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The script installs a Python wheel directly from a remote URL during initialization, giving the skill the ability to fetch and execute new code on demand. That is dangerous because it bypasses normal dependency review and makes compromise of the hosting location or transport path equivalent to arbitrary code execution in the skill environment.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs network fetches and package installation without clear disclosure or consent, so users invoking an audio-processing skill may unknowingly trigger external communications and code changes. In a security-sensitive environment, this undermines transparency, reviewability, and change control, increasing the chance that malicious or unexpected behavior goes unnoticed.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.