Security audit

Byted Mediakit Audio

Security checks across malware telemetry and agentic risk

Overview

This audio-processing skill appears purpose-aligned, with the main caveat that cloud modes may expose supplied URLs or media to a remote service.

Install is reasonable if you understand that cloud modes can send supplied media URLs or content to remote infrastructure. Avoid private, signed, internal, confidential, or regulated media unless you have authorization, and prefer local mode where available.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The skill describes probing user-supplied audio URLs through a remote service but does not clearly warn users that the supplied URL may be transmitted to an external endpoint for processing. In a shell-permitted skill that supports cloud execution, this can expose sensitive URLs, signed links, internal resource locations, or metadata to third-party infrastructure without informed user consent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs users to submit publicly accessible audio or video URLs to a cloud-only service, but it does not warn that the media will be transmitted to and processed by a remote system. This can expose sensitive audio content, embedded personal data, or confidential media metadata if users assume processing is local or do not understand the privacy implications.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.