audio-enhancement-engine

• Outcome: Review
• Latest audit: Jul 3, 2026 · 2:30 PM UTC
• Version: 1.0.5

Overview

This audio skill appears functional, but it automatically downloads software and changes the Python environment in ways its local-audio description does not clearly disclose.

Install only if you are comfortable with the skill downloading models and binaries, creating or changing a Python virtual environment, and installing or force-reinstalling many third-party packages during use. Prefer running it in an isolated environment and review the dependency sources first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (52)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
        logger.info("   自动确认下载中...")
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
        
        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 84% confidence
• Finding: The code invokes an external installer command via subprocess and automatically feeds confirmation input, causing network-retrieved software to be installed without an explicit user approval step at execution time. Even though shell injection is not present because arguments are passed as a list, this still expands the skill's trust boundary to external binaries and package sources, which is risky for a skill advertised as local audio processing.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 91% confidence
• Finding: This subprocess call performs a pip install during module import, creating immediate package-management side effects without user approval. Even though the command is hardcoded, it modifies the runtime environment and can pull code from package indexes, which expands the attack surface and can enable dependency-based code execution or environment tampering.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 91% confidence
• Finding: This call force-reinstalls setuptools and wheel on import, altering core packaging infrastructure for the Python environment. Reinstalling foundational build tools automatically is risky because it can break unrelated software, enable dependency confusion/supply-chain exposure, and violates least surprise for an audio-processing skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 97% confidence
• Finding: This subprocess invocation executes pip install for arbitrary specs, including git URLs, direct URLs, local archives, and package names. In this skill context, that is especially dangerous because a nominally audio-only skill gains the ability to fetch and install arbitrary code, creating a strong path to remote code execution and supply-chain compromise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 96% confidence
• Finding: This subprocess call installs a package string assembled from function arguments, enabling runtime environment mutation and potential installation of unintended or malicious packages. Although aimed at convenience, it still provides a code-fetching and execution path unrelated to direct audio enhancement and lacks explicit consent controls.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 95% confidence
• Finding: The fallback installer executes pip against a local zip path, which permits installation from arbitrary local archives when git-based installation fails. That creates another code execution vector and weakens provenance controls, especially problematic in a skill that should only process audio files rather than manage software packages.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 87% confidence
• Finding: This script automatically performs network package installation during skill startup, which executes arbitrary third-party package build/install code with the user's privileges. Even without explicit attacker input, unpinned and implicitly trusted package resolution substantially expands the attack surface and can lead to supply-chain compromise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

• Confidence: 92% confidence
• Finding: Installing torch/torchvision/torchaudio from a dynamically selected external index at runtime introduces a supply-chain execution path. Pip installation can run package code and download large binary artifacts, so compromise of dependency resolution, mirrors, or version drift could result in arbitrary code execution in the local environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 84% confidence
• Finding: Runtime installation of pydub from the network still creates a supply-chain execution risk, though the package itself is not especially privileged beyond the process context. The main issue is not the subprocess primitive but the trust model of automatically fetching and executing dependency installation logic during normal skill use.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 84% confidence
• Finding: Automatically installing huggingface-hub at runtime expands network and supply-chain exposure beyond the core audio enhancement task. If dependency metadata or upstream artifacts are compromised, installation may execute attacker-controlled code in the user's environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 audio-separator + librosa（你提到的）
        if use_gpu:
            logger.info("安装 audio-separator GPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

• Confidence: 89% confidence
• Finding: Installing audio-separator[gpu] at runtime is risky because extras may pull in a larger transitive dependency set and execute installer hooks, increasing supply-chain attack surface. In this skill, that is more concerning because audio separation is outside the narrowly advertised audio enhancement scope, so users may not expect that capability or dependency footprint.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])

• Confidence: 89% confidence
• Finding: The CPU variant of audio-separator carries the same fundamental risk: automatic network dependency installation with code execution potential during install. Because the package introduces functionality beyond the stated enhancement/repair purpose, it also represents an unnecessary expansion of capability and attack surface.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("下载来源：Windows=gyan.dev | Linux=johnvansickle | macOS=evermeet")

        # 自动确认下载（无交互）
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)

        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 89% confidence
• Finding: The code launches an external installer command (`ffdl install`) automatically and feeds confirmation input without any user approval. Even though `shell=False` avoids shell injection, this still executes a network-enabled installer from the user's environment/PATH, which can fetch and install binaries from remote sources and expands the skill's behavior beyond local audio processing.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
    
    logger.info("正在安装（这步通常很快）...")
    subprocess.run(install_cmd, check=True)
    
    # 验证（跨平台兼容）
    pip_str = str(venv_pip)

• Confidence: 91% confidence
• Finding: This subprocess invocation installs locally downloaded wheel files into the detected virtual environment with force-reinstall, giving the script package-management and code-deployment capability that is unrelated to ordinary audio enhancement. Because the script also performs remote downloads earlier, a compromised or substituted wheel would be executed on install, resulting in arbitrary code execution in the environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions even though its documented behavior invokes Python scripts, reads user-supplied paths, shells out, and the static analysis indicates network/environment access. This is dangerous because users and the platform may treat it as low-risk while it can execute commands and potentially fetch remote resources, expanding the attack surface beyond simple local audio processing.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a significant description-behavior mismatch: the skill claims to be fully local and centered on two tools, but analysis indicates undeclared third-party modes, automatic package/git installation, ffmpeg download, model/code retrieval from Hugging Face/GitHub, virtualenv manipulation, and PyTorch replacement. Such hidden setup and remote fetching can lead to unreviewed code execution, supply-chain risk, unexpected network activity, and system modification under the guise of simple audio enhancement.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README expands the skill’s effective scope by documenting a third processing mode (`--re` / Resemble-Enhance) that is not declared in the metadata, which can mislead the orchestrator, reviewers, and users about what code paths and dependencies may be invoked. In an agent skill context, undocumented capability drift matters because it weakens trust boundaries and can cause unreviewed model downloads, execution paths, or behaviors to be triggered under the guise of a narrower audio-only tool.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The implementation exposes a third processing mode, Resemble-Enhance, that is absent from the manifest and user-facing description. This mismatch undermines user consent and reviewability because the skill can execute capability paths that were not disclosed during installation or approval.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill installs numerous packages at runtime, including one directly from a GitHub URL, which enables arbitrary third-party code retrieval and execution outside a locked dependency supply chain. For a supposedly local-only audio tool, this materially increases supply-chain and remote code execution risk, especially because these installs occur automatically when the script runs.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill downloads ffmpeg from the internet at runtime despite being described as fully local. Downloading and trusting a binary during execution introduces a significant supply-chain risk and may bypass organizational controls that would normally vet external software acquisition.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file's functionality does not match the declared audio-enhancement purpose and instead implements a general package installer. This mismatch is dangerous because it grants broad environment-modification capability under the cover of an audio skill, increasing the likelihood of hidden or unjustified code-execution pathways.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This code can install packages from network locations, git repositories, and local artifacts based on arbitrary specs, which is far beyond the stated skill purpose. In practice, this provides a general software installation primitive that can be abused for supply-chain compromise or arbitrary code execution.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The module invokes package-repair/install logic automatically at import time, causing side effects before any explicit audio request is processed. Import-time execution is especially risky because merely loading the skill mutates the environment and may trigger code fetching or package installation without informed consent.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The docstring labels the module as part of the audio skill while describing it as a package installation tool, signaling intent drift and reducing transparency. This inconsistency makes security review harder and can conceal risky capabilities inside a seemingly benign skill package.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill claims to be a local audio enhancement engine, but this environment manager silently performs network installs and brings in dependencies not directly tied to the user-facing enhancement workflow. That mismatch matters because it violates least surprise and broadens both capability and supply-chain exposure beyond what users would reasonably infer from the manifest.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.