T08 · Insecure Dependencies
Error
- Location
scripts/audio_slicer.py:28- Finding
Automatic Installation and Execution of Unpinned Third-Party Components
- Content
View full analysis
- Remediation
View remediation
Security audit
audio-segmenter
Security checks for vulnerabilities and agentic risk
Overview
The skill does slice audio, but it also automatically installs packages and downloads FFmpeg in ways that can change the user's Python environment.
Review this before installing if you are not comfortable with automatic network downloads and Python environment changes. Prefer running it in an isolated sandbox or disposable virtual environment, and require pinned dependencies plus verified FFmpeg binaries before using it on sensitive systems.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ensure_package.py:28- Finding
Import-Time Modification of the Invoking Python Environment
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/config.py:28- Finding
Shared Virtual Environment Allows Cross-Skill Dependency Contamination
- Content
View full analysis
- Remediation
View remediation
/.venv`. 2. Ensure the environment is writable only by the account responsible for the Skill. 3. Do not reuse the environment across independently trusted Skills. 4. Pin all direct and transitive dependencies with hashes. 5. Validate the active interpreter against the expected Skill-specific environment before loading third-party packages. 6. Recreate the environment from the lock file when dependency integrity cannot be established. 7. Apply sandboxing so each Skill receives only the filesystem, network, and tool permissions required for its task. 8. Avoid automatically upgrading `pip` or dependencies during normal Skill execution. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (38)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation does not actually process audio or invoke ffmpeg, the skill is misrepresenting its purpose. Security-wise, deceptive functionality reduces informed consent and can hide unrelated actions, especially when combined with shell execution and filesystem access in a skill users believe is only doing deterministic media splitting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation does not actually process audio or invoke ffmpeg, the skill is misrepresenting its purpose. Security-wise, deceptive functionality reduces informed consent and can hide unrelated actions, especially when combined with shell execution and filesystem access in a skill users believe is only doing deterministic media splitting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the implementation does not actually process audio or invoke ffmpeg, the skill is misrepresenting its purpose. Security-wise, deceptive functionality reduces informed consent and can hide unrelated actions, especially when combined with shell execution and filesystem access in a skill users believe is only doing deterministic media splitting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the implementation does not actually process audio or invoke ffmpeg, the skill is misrepresenting its purpose. Security-wise, deceptive functionality reduces informed consent and can hide unrelated actions, especially when combined with shell execution and filesystem access in a skill users believe is only doing deterministic media splitting.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file implements a general-purpose package installer with environment-repair behavior rather than audio segmentation logic promised by the skill manifest. This mismatch is a strong indicator of hidden or unjustified capability, increasing suspicion because it introduces privileged code-fetching behavior unrelated to the user-facing purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code can install packages from PyPI, git repositories, arbitrary URLs, wheels, and local zip archives, which effectively gives the skill a runtime code acquisition and execution capability. In the context of an audio-segmentation skill, this is unjustified and materially more dangerous because users would not expect the skill to modify the environment or fetch arbitrary code.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file behavior materially exceeds the manifest's narrow audio-segmentation purpose by performing environment initialization, hardware probing, and dependency deployment. This scope mismatch is dangerous because users or reviewers may authorize an audio utility while actually granting code that can modify the execution environment and fetch software.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Creating virtual environments, upgrading pip, and preparing to install dependencies gives the skill the ability to alter the host Python environment and introduce new executable code. For an audio-segmentation skill, this is excessive capability and increases risk from supply-chain compromise, unexpected persistence, or unauthorized host modification.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python sys.exit(1) # 传递环境变量防止递归 env = os.environ.copy() env["RUNNING_IN_VENV"] = "true" logger.info(f" 当前Python: {sys.executable}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly advertises silent dependency installation and automatic FFmpeg download, which means executing the skill can trigger unannounced network access, package installation, environment creation, and binary acquisition. In an agent/tooling context this is risky because users may believe they are only slicing local audio, while the skill can modify the system and pull code/binaries from external sources without informed consent.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill requests shell-capable behavior and references reading files/environmental setup, but does not declare any explicit tool scope or permissions boundaries. In practice this weakens sandboxing and reviewability, making it easier for a skill that launches Python and potentially installs dependencies to exercise broader capabilities than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill does not clearly warn that it will generate potentially large numbers of output files and directories. This can lead to accidental disk consumption, clutter, and unintended modification of nearby folders, which is especially relevant for recursive processing of large media trees.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Overly broad trigger phrases like generic references to cutting, splitting, or processing audio can cause unintended invocation of a shell-executing skill. In this context that is more dangerous because the skill may create files, traverse folders, and run Python automatically when the user may have intended only a conversational request or a different audio action.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill auto-installs Python packages during execution, which is broader than its stated audio-splitting purpose and causes unannounced system changes. Runtime dependency installation exposes the user to supply-chain risk and unpredictable behavior if package indexes, mirrors, or transitive dependencies are compromised.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Automatically downloading and installing ffmpeg expands the skill's behavior from file processing into software deployment. In the context of an agent skill, this is risky because it can fetch executable binaries from external sources and alter PATH without the user explicitly approving the system modification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script silently downloads and installs ffmpeg without prominently warning that it will modify the local system. Hidden or insufficiently disclosed installation behavior is risky in an automation context because users may believe they are only processing files, while the skill actually retrieves and executes external software.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 89% confidence
- Finding
The script invokes an external installer command to fetch and install ffmpeg at runtime, which executes code and modifies the host environment outside the narrow task of slicing audio. Even though the command arguments are not user-injected here, automatic installation increases supply-chain and environment-modification risk, especially in an agent skill that may run with the user's privileges.
- Content
python # 🔥 关键：自动输入 Y（默认 yes），彻底无交互 logger.info(" 自动确认下载中...") subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True) # 下载完后刷新模块 importlib.reload(ffdl)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill performs environment and virtual-environment setup, including a comment indicating GPU-related initialization, which is outside the declared scope of simple audio slicing. Scope creep in an agent-executed skill is dangerous because it grants the script authority to modify runtime state and potentially install or configure additional components unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The primary natural-language description and feature list are written entirely in Chinese, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context. Under the language/locale policy, this is a natural-language policy violation because it imposes a specific language without opt-in.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The module performs a pip install at import time, which causes automatic execution of package-management side effects whenever this file is loaded. Even though the arguments are not shell-interpreted, this still downloads and installs code into the runtime environment, creating a supply-chain and integrity risk that is unrelated to the stated audio-segmentation purpose.
- Content
python """专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本""" try: # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错） subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ])
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
This code force-reinstalls setuptools and wheel at import time, altering the Python toolchain for the whole environment. Such behavior can destabilize other packages, bypass expected dependency controls, and expands the attack surface through unneeded package installation in a skill that should only segment audio.
- Content
python "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ]) # 再安装兼容的 setuptools + wheel subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel" ])
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 第一步：尝试 import 检查（最快） try: parts = import_name.split('.') mod = __import__(parts[0]) for part in parts[1:]: mod = getattr(mod, part) if sub_import:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This function executes pip install on a spec that explicitly supports package names, git URLs, arbitrary URLs, wheels, and local zip files. That enables runtime installation of untrusted code from multiple sources, which is a severe supply-chain risk and especially suspicious because it is generic package-management logic embedded in an audio-segmentation skill.
- Content
python cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"]) try: subprocess.check_call(cmd) logger.info(f"✅ {spec} 安装/升级完成！") except subprocess.CalledProcessError as e:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The fallback path installs a local zip archive as code when git-based installation fails. Installing executable packages from local archives at runtime bypasses normal review and provenance controls, and together with the generic installer design creates an unjustified code-execution mechanism inside a simple audio utility.
- Content
python sys.executable, "-m", "pip", "install", "--upgrade", fallback_zip, "--verbose" ] subprocess.check_call(cmd_fallback) logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！") return except subprocess.CalledProcessError as e2:
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # ==================== 1. 检查是否已安装 + 版本是否满足 ==================== try: __import__(import_name) # 尝试获取当前版本 try:
Static analysis
No suspicious patterns detected.