audio-segmenter

• Outcome: Review
• Latest audit: Jul 3, 2026 · 2:29 PM UTC
• Version: 1.1.9

Overview

The skill performs audio slicing, but it also automatically installs packages, changes Python tooling, creates a virtual environment, and downloads FFmpeg without a clear user approval step.

Review before installing. Use this only in an isolated environment where automatic Python package installs, package-toolchain changes, network downloads, a shared virtual environment, logs, and generated output files are acceptable. Avoid running it against sensitive directories unless you are comfortable with recursive local file processing and persistent setup artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (26)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
        logger.info("   自动确认下载中...")
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
        
        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 91% confidence
• Finding: The script launches an external installer command via subprocess to fetch and install ffmpeg automatically. Even though the argv is hardcoded and not user-injected, this still introduces supply-chain and arbitrary binary execution risk because the skill performs network-backed installation and executes whatever the installer resolves on the host PATH.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 95% confidence
• Finding: This code invokes pip via subprocess to modify the Python environment at runtime, which is a risky capability for a skill and can introduce unreviewed code into the execution environment. Even though the package name here is hardcoded, automatic installation of dependencies on import expands attack surface and enables supply-chain compromise if the package source or resolution path is tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 96% confidence
• Finding: This subprocess call force-reinstalls setuptools and wheel, altering core packaging components of the host Python environment. Replacing foundational tooling at runtime can destabilize the environment, break isolation assumptions, and make later package installations execute attacker-controlled build logic if dependency sources are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 99% confidence
• Finding: This is the core arbitrary package installation sink: the function constructs a pip install command from the spec parameter and executes it. Because spec supports package names, git+ URLs, archives, and other remote sources, any attacker influence over that input can lead to installation and execution of untrusted code, creating a supply-chain-based remote code execution path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 98% confidence
• Finding: This helper installs a package string assembled from pkg plus an optional version constraint and executes pip directly. Although somewhat narrower than the generic installer, it still enables environment modification and unreviewed code introduction at runtime, which is unjustified for an audio-segmentation skill and dangerous if inputs are influenced by other code paths.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 97% confidence
• Finding: The fallback path installs a local zip package via pip when git installation fails. Installing arbitrary local archives is dangerous because Python package installation can execute build/install hooks, so any attacker-controlled zip placed at the expected path could achieve code execution under the skill's privileges.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions, yet its documented behavior invokes Python, reads user-supplied files and paths, and executes shell commands. This creates a trust and review gap: operators and users cannot accurately assess what the skill is allowed to do, and hidden shell/file capabilities increase the chance of unsafe execution on arbitrary paths.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to slice audio, but the documented execution path also creates virtual environments, reinstalls packaging tools, installs Python dependencies, and may download/install ffmpeg. That behavior materially expands the attack surface from local media processing to arbitrary software installation and environment modification, which can lead to supply-chain compromise or unauthorized system changes.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The README explicitly states that the skill will automatically create a virtual environment, install dependencies, and silently download FFmpeg. Those behaviors exceed the narrow user expectation of "split audio" and introduce unprompted code/software acquisition from external sources, increasing supply-chain and unexpected system-modification risk. In an agent skill context, hidden environment bootstrapping is more dangerous because users may invoke it through natural language without realizing it will perform network activity and install executables.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill installs Python packages at runtime, which exceeds a narrowly scoped local audio-slicing utility and adds supply-chain exposure. Runtime dependency installation can execute untrusted package setup logic or pull compromised versions, turning a local media task into network-enabled code execution.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Calling external package installation mechanisms is a broader capability than the stated function requires and creates a path for unintended code execution from package repositories. In an agent skill context, hidden installer behavior is particularly risky because users may expect only local file processing.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The function automatically downloads ffmpeg from external sources and then executes installer logic without explicit runtime consent. This expands the trust boundary from local audio processing to remote artifact retrieval and execution, which is a classic supply-chain risk.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements a general package installer rather than audio segmentation logic, creating a major mismatch between declared purpose and actual capability. Capability mismatch is dangerous because it can conceal high-risk behaviors from users and reviewers, especially when those behaviors modify the system and fetch code.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This block performs pip installs and upgrades of arbitrary packaging components during normal code execution, despite being unrelated to audio splitting. In the context of a narrow-purpose audio skill, this unjustified capability substantially raises suspicion and creates a powerful path for environment tampering and supply-chain compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Supporting git repositories, URLs, wheels, and zip archives as runtime installation sources is a broad code-ingestion capability unrelated to the manifest's audio-segmentation purpose. In this context, it is especially dangerous because it can be abused to fetch and install attacker-controlled code under the guise of a benign media-processing skill.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file-level documentation explicitly describes a package installation tool, contradicting the skill identity of an audio segmenter. This mismatch suggests hidden or at least poorly scoped functionality, undermining transparency and increasing the chance that risky behavior escapes scrutiny.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file's documented and implemented behavior is environment bootstrapping, dependency installation, and hardware probing, which materially differs from the manifest's claimed purpose of simple ffmpeg-based audio segmentation. This mismatch is dangerous because users may grant execution expecting a narrow audio utility while the skill actually performs broad system changes and capability expansion.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script creates a virtual environment and invokes pip to modify the host filesystem and install software, actions that are outside the expected scope of an audio-splitting helper. Even if not overtly malicious, hidden environment mutation increases attack surface, introduces supply-chain risk, and violates least surprise for users invoking a media utility.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Auto-installation of ML/audio packages and GPU/CUDA probing are disproportionate to the declared ffmpeg-based segmentation task and therefore expand the skill's privileges and operational footprint unnecessarily. In skill ecosystems, such scope expansion is risky because it can mask nonessential behaviors behind a benign manifest.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The module documentation openly describes a bootstrapper responsible for environment enforcement, GPU inspection, and dependency deployment, contradicting the skill manifest that presents a narrow audio segmentation tool. Documentation-level contradiction is a trust and transparency issue because it conceals actual capabilities from users and reviewers at the manifest layer.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Documenting silent dependency installation and FFmpeg download without warning users about outbound network access or local system changes is a security transparency problem. Silent downloads can bypass user scrutiny, obscure provenance, and make it easier for a compromised mirror or package source to introduce malicious binaries or packages. The skill context makes this more dangerous because the task appears simple and local, so users are less likely to expect internet access or executable acquisition.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases include broad, common terms such as '切片', '分段', and general audio-processing requests, which can cause the skill to activate in unintended contexts. Because the skill runs shell-based processing on user-provided paths, accidental invocation can lead to unreviewed file traversal/processing and unexpected system changes if the underlying script performs setup actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code auto-confirms installation by piping 'Y' into the installer, preventing the user from reviewing or declining the download of an external executable. In an agent environment, silent installation undermines informed consent and can be abused to introduce software the user did not intend to run.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The call to fix_setuptools_for_legacy_packages() runs at import time, causing immediate environment modification without user confirmation. Import-time side effects are especially dangerous because simply loading the module triggers package installation and toolchain changes, violating least surprise and enabling stealthy system alteration.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: Creating a virtual environment and upgrading pip performs persistent system changes without an explicit consent checkpoint at the point of action. In the context of a simple audio-splitting skill, silent environment mutation is especially problematic because users do not reasonably expect package-management side effects from the declared functionality.

Static analysis

No suspicious patterns detected.