funasr-punctuation-restore

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:02 PM UTC
• Version: 1.0.8

Overview

This skill mostly performs punctuation restoration, but it also modifies Python environments and installs large or unrelated packages in ways that need careful review before use.

Install only if you are comfortable with this skill creating or reusing a local Python environment, downloading models and packages from the network, probing GPU tools, and reading/writing user-selected text files or directories. Prefer running it in an isolated environment and review the scripts first, especially because it installs unrelated audio packages and mutates packaging tools automatically.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 90% confidence
• Finding: This code automatically runs pip at import time to reinstall the packaging library, mutating the Python environment without user consent. Even though the command is statically defined, unsolicited dependency installation expands the attack surface and can destabilize or hijack the runtime if indexes, TLS trust, or package resolution are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 90% confidence
• Finding: The script force-reinstalls setuptools and wheel during import, altering core packaging tooling for the whole environment. Changing foundational packages as a side effect of a text punctuation skill is unjustified and can break other software or enable supply-chain risk if package retrieval is intercepted or poisoned.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This function executes pip install on a caller-controlled spec and explicitly supports remote git/HTTP sources and local archives. In the context of a punctuation-restoration skill, that creates an unnecessary arbitrary code acquisition path because installing packages can execute untrusted build backends or setup logic.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 95% confidence
• Finding: This helper installs arbitrary packages with version constraints through pip, mutating the environment at runtime. For a punctuation skill, such generic installation capability is unrelated to core functionality and increases supply-chain and arbitrary code execution risk through package installation hooks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 96% confidence
• Finding: The fallback path installs a local zip archive through pip, which can execute arbitrary build/install code from a file path. Accepting local archives as a recovery mechanism broadens the attack surface and can be abused if an attacker can influence the archive path or contents.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 84% confidence
• Finding: The skill automatically upgrades pip inside a newly created environment without explicit user consent. In the context of a punctuation-restoration skill, silent package installation from the network expands the trust boundary and can execute arbitrary code from package install hooks or compromised dependencies.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

• Confidence: 90% confidence
• Finding: This code installs large third-party packages from a remote index selected at runtime based on hardware probing, without user confirmation. Automatic dependency installation is dangerous because package downloads and install-time code execution can lead to supply-chain compromise, especially when the skill's stated purpose is only text punctuation restoration.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: The skill silently installs pydub at runtime, which is beyond the minimum functionality for punctuation restoration and enlarges the attack surface. Any automatic pip install introduces supply-chain and install-hook execution risk, especially without user awareness or consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: This runtime installation of huggingface-hub similarly performs unprompted network retrieval and package installation unrelated to the narrow user task. In a skill advertised for punctuation restoration, hidden dependency bootstrap behavior is more suspicious and increases exposure to malicious or compromised packages.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 audio-separator + librosa（你提到的）
        if use_gpu:
            logger.info("安装 audio-separator GPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

• Confidence: 91% confidence
• Finding: Installing audio-separator[gpu] and librosa at runtime is especially concerning because these are unrelated to restoring punctuation in text and pull in substantial extra dependency trees. That mismatch between declared purpose and behavior materially raises risk, since unnecessary packages create needless supply-chain and code-execution exposure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])

• Confidence: 91% confidence
• Finding: The CPU variant of audio-separator plus librosa has the same problem as the GPU path: runtime installation of unrelated audio packages broadens the attack surface far beyond the text punctuation use case. The unnecessary capability mismatch makes this more dangerous than a routine dependency install.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill invokes Python scripts, reads user-supplied files/directories, writes output files, and executes shell commands, yet it declares no corresponding permissions. This undermines informed consent and platform policy enforcement, and increases the risk that users or orchestrators trigger filesystem and command execution capabilities they did not expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims to only restore punctuation, but its described behavior includes virtualenv creation, hardware probing, package installation, external model/dependency downloads, and unrelated audio dependencies. This materially expands the trust boundary from simple text processing to arbitrary environment modification and network-driven code supply-chain risk, making exploitation or unintended side effects much more severe.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The script performs immediate environment mutation by installing and reinstalling packaging components unrelated to punctuation restoration. Because this occurs at module load, simply importing the skill can change the host environment and introduce supply-chain, stability, and persistence risks far beyond the declared feature scope.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code provides a generic package installer that accepts remote git/HTTP sources and local zip/whl archives, all of which can lead to arbitrary code execution during installation. That capability is unjustified for a text punctuation skill and materially increases risk because package installation commonly runs untrusted build scripts and backend code.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The module advertises itself as a general-purpose Python package installer with git and zip fallback logic, which is inconsistent with the declared punctuation-restoration skill. This scope mismatch is dangerous because it normalizes environment-modifying behavior that users would not expect from a text-processing utility, making the risky installer functionality harder to justify or notice.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The bootstrapper installs audio-processing dependencies even though the skill is described as handling only text punctuation restoration. This capability mismatch is dangerous because it introduces unnecessary code, network access, and transitive dependencies that can be abused or compromised without benefiting the advertised function.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code performs GPU/driver probing and network-based package installation far beyond the stated punctuation-restoration purpose. In context, that hidden bootstrap behavior increases risk because it expands privilege and trust requirements, creates supply-chain exposure, and can surprise users who expect a local text-processing tool.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill performs automatic network downloads of a model at runtime via ModelScope, even though its advertised function is local punctuation restoration. This expands the trust boundary to remote content and enables supply-chain risk, unexpected outbound network access, and non-deterministic execution if a compromised or swapped model/package is fetched.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script dynamically installs Python packages at runtime using pip before processing input. Runtime dependency installation is dangerous because it permits arbitrary code from package install hooks or compromised dependencies to execute in the agent environment, turning a simple text-processing skill into a code-fetching and code-execution path.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The README advertises very broad natural-language trigger phrases such as '帮我给这段文本加标点' and '把这个无标点文本变正常', which are likely to overlap with ordinary conversation and can cause unintended auto-invocation of the skill. Because this skill can also operate on files and directories, a false trigger may lead to unexpected filesystem reads and bulk processing of user data even when the user did not explicitly intend to run the tool.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger phrases are broad everyday language, so the skill may auto-activate in common conversations involving text cleanup or punctuation. In a skill that can execute code, access files/directories, and potentially install software, over-broad triggering raises the chance of unintended invocation and accidental exposure of local paths or execution of side-effecting operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically creates environments, upgrades pip, and installs packages while only emitting progress logs. Lack of explicit warning and consent is a real security concern because users may unknowingly trigger network access and code execution during installation, which is disproportionate for a punctuation helper.

Static analysis

No suspicious patterns detected.