Security audit

audio-enhancement-engine

Security checks for vulnerabilities and agentic risk

Overview

This is a real audio-enhancement skill, but it automatically changes the Python environment and downloads executable/model code without strong integrity controls.

Review before installing. Use this only in an isolated environment where automatic package installs, FFmpeg downloads, model downloads, and large ML dependencies cannot access sensitive files or credentials. Prefer a version that pins dependencies and model revisions, verifies hashes, and asks before downloading or modifying the environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/ensure_package.py:131
Finding: Automatic Installation of Mutable and Unverified Third-Party Dependencies
Content: View full analysis
=1.12.0") ensure_package.pip( "git+https://github.com/qiuqiangkong/torchlibrosa.git", fallback_zip="torchlibrosa-master.zip" ) ensure_package.pip("matplotlib") ensure_package.pip("ffmpeg-downloader") ensure_package.pip("pydub", "pydub", "AudioSegment") ensure_package.pip("transformers") ``` ```python # scripts/voice_enhance.py:21-26 ensure_package.pip("packaging", "packaging", "version") ensure_package.pip("audio-separator==0.30.2", force=True) ensure_package.pip("numpy==1.26.4", force=True) ensure_package.pip("librosa==0.10.2", force=True) ensure_package.pip( "git+https://github.com/haoheliu/voicefixer.git", fallback_zip="voicefixer-main.zip" ) ensure_package.pip("hf_transfer") ``` ```python # scripts/hifi_audio_enhance.py:25-31 ensure_package.pip("torch") ensure_package.pip("torchaudio") ensure_package.pip("torchvision") ensure_package.pip( "git+https://github.com/haoheliu/versatile_audio_super_resolution.git", fallback_zip="versatile_audio_super_resolution-main.zip" ) ensure_package.pip("huggingface_hub") ensure_package.pip("torchcodec") ``` ```python # scripts/run_resemble_enhance.py:20-36 ensure_package.pip("torch") ensure_package.pip("soundfile") ensure_package.pip("numpy==1.26.4") ensure_package.pip("librosa==0.10.2") ens ...[truncated 4066 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/enhancer.py:42
Finding: Automatic Download and Installation of an Unverified FFmpeg Executable
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/resemble_enhance/enhancer/inference.py:11
Finding: Mutable Remote Model Update Followed by Unsafe PyTorch Deserialization
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/ensure_package.py:26
Finding: Import-Time Forced Replacement of Core Python Packaging Components
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (147)

Known Vulnerable Dependency: torch==2.1.1 — 16 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution); CVE-2024-31580 (PyTorch heap buffer overflow vulnerability) +13 more

Critical

Category: Supply Chain
Confidence: 99% confidence
Finding: torch==2.1.1 is flagged with multiple advisories, including issues involving remote code execution in model deserialization and memory-safety/denial-of-service flaws. This is especially risky in an AI/audio skill because PyTorch-based tools commonly load checkpoints and serialized model artifacts, making vulnerable torch versions a strong attack surface if untrusted models or crafted files are introduced.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: These description-behavior mismatches are credible security issues because the skill is presented as a local audio-only enhancement tool, while the analyzed implementation reportedly performs unrelated activities such as dependency installation, network downloads, environment mutation, training/orchestration utilities, logging, stdin handling, and distributed setup. Misrepresenting behavior prevents informed consent and can hide risky actions behind a benign audio-processing facade.
Content: No source excerpt is available for this finding.