T08 · Insecure Dependencies
Error
- Location
scripts/ensure_package.py:30- Finding
Import-Time Installation of Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
melo-tts-metadata-creator
Security checks for vulnerabilities and agentic risk
Overview
The skill can generate MeloTTS metadata, but it also automatically modifies Python environments and downloads large unpinned dependencies in ways users are not clearly asked to approve.
Review before installing. Use only in an isolated disposable environment, expect network downloads and large package/model installs, avoid sensitive audio or transcript folders unless you accept local processing, and inspect generated metadata.list for malformed or injected records. Do not run it in a shared Python environment without pinning and reviewing dependencies first.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/config.py:36- Finding
Shared Virtual Environment Is Modified with Excessive Unpinned Dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_metadata_list.py:79- Finding
Unescaped Transcript and Speaker Fields Permit Metadata Record Injection
- Content
View full analysis
1 else "default_speaker" txt_path = (txt_dir / rel_path).with_suffix(".txt") abs_wav = str(wav_path.resolve()) if txt_path.exists(): text = txt_path.read_text(encoding="utf-8").strip() source = "from .txt" elif args.use_whisper and model is not None: result = model.transcribe(str(wav_path), language=args.lang.lower()) text = result["text"].strip() txt_path.parent.mkdir(parents=True, exist_ok=True) txt_path.write_text(text, encoding="utf-8") source = "Whisper" ``` The values are then inserted directly into a pipe-delimited record: ```python line = f"{abs_wav}|{speaker}|{args.lang}|{text}" lines.append(line) ``` ### Technical Analysis The metadata format requires exactly four fields separated by `|`, with one logical record per line. The implementation does not reject or escape the pipe character, carriage returns, or newline characters in `speaker` or `text`. A transcript containing `|` creates additional fields. A transcript containing `\n` or `\r\n` creates additional physical records. A malicious or untrusted dataset can therefore inject forged metadata lines into the output. A command-line speaker value containing the same characters can cause equivalent corruption. This is structured-output injection rather than shell-command injection. Exploitation affects consumers that trust `metadata.list` to have exactly four fields per line. ### Attack Path 1. An attacker supplies or modifies a `.txt` transcript corresponding to a WAV file. 2. The transcript includes reserved delimiters or an injected rec ...[truncated 1217 chars]- Remediation
View remediation
str: if any(char in value for char in ("|", "\r", "\n")): raise ValueError(f"Invalid reserved character in {field_name}") return value speaker = validate_field(speaker.strip(), "speaker") text = validate_field(text.strip(), "text") line = f"{abs_wav}|{speaker}|{args.lang}|{text}" if len(line.split("|")) != 4: raise ValueError("Generated metadata record does not contain exactly four fields") ``` 6. Validate directory-derived speaker names using the same rules as command-line speaker names. 7. Treat datasets and transcript files as untrusted input. 8. Add automated tests covering pipes, LF and CRLF line endings, empty values, Unicode content, and forged record payloads. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (44)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text venv/ ENV/ env/ .env # Logs logs/*.log
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic virtual environment creation, GPU/CUDA probing, PyTorch variant installation, and process re-execution are all powerful host-level behaviors unrelated to the narrow user-facing description. These actions can modify the system state, pull large external dependencies, and create opaque execution paths that make review and containment much harder.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic virtual environment creation, GPU/CUDA probing, PyTorch variant installation, and process re-execution are all powerful host-level behaviors unrelated to the narrow user-facing description. These actions can modify the system state, pull large external dependencies, and create opaque execution paths that make review and containment much harder.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Automatic virtual environment creation, GPU/CUDA probing, PyTorch variant installation, and process re-execution are all powerful host-level behaviors unrelated to the narrow user-facing description. These actions can modify the system state, pull large external dependencies, and create opaque execution paths that make review and containment much harder.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Automatic virtual environment creation, GPU/CUDA probing, PyTorch variant installation, and process re-execution are all powerful host-level behaviors unrelated to the narrow user-facing description. These actions can modify the system state, pull large external dependencies, and create opaque execution paths that make review and containment much harder.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a generic package installer rather than MeloTTS metadata generation, which is a strong capability mismatch. Such hidden or unrelated functionality is dangerous because it expands the skill's privileges and attack surface beyond what users and reviewers would reasonably expect.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The module mutates the environment on import by reinstalling packaging-related components before any business logic runs. Import-time side effects are especially dangerous because they trigger automatically, are hard for callers to anticipate, and can alter or break unrelated workloads while exposing the host to package-supply-chain risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section can install arbitrary packages from remote repositories and local archives, including git and zip sources, with minimal restriction. In a skill whose declared purpose is metadata file generation, this is unjustified and significantly more dangerous because it enables supply-chain compromise and arbitrary code execution through dependency installation.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python sys.exit(1) # 传递环境变量防止递归 env = os.environ.copy() env["RUNNING_IN_VENV"] = "true" logger.info(f" 当前Python: {sys.executable}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises automatic Whisper transcription, model download to ./models/, and output file generation while downplaying operational side effects by stating failures are skipped automatically. In practice, this implies network access, local disk writes, and processing of potentially sensitive audio/text data without prominent warnings or consent guidance, which can lead to unintended privacy exposure or unauthorized environment changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README includes broad natural-language trigger phrases such as '帮我生成 MeloTTS 的 metadata.list' and similar variants without clearly constraining required paths, confirmation steps, or scope. In an agent setting, this can cause the skill to activate on ambiguous user requests and perform filesystem scanning, transcription, or file generation on unintended directories, increasing the risk of overbroad actions and accidental data processing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares only a minimal binary requirement while the documented behavior invokes shell execution, reads user-supplied directories, and writes output files. Without an explicit tool/permission scope, the runtime may grant broader-than-necessary capabilities, increasing the chance of unintended file access or command execution abuse if parameters are manipulated or future code expands behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content of the skill is written entirely in Chinese and does not indicate that users may interact in other languages or opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the constraint is clearly justified as region-specific.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation openly describes the module as an intelligent package installer, contradicting the skill manifest's claimed MeloTTS metadata-only behavior. This mismatch is a security concern because it signals undeclared capabilities and reduces reviewer/operator ability to make informed trust decisions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Performing package installation and environment modification at import time without confirmation is unsafe operational behavior. It can surprise users, violate least astonishment, and lead to unwanted code installation or breakage simply from loading the skill.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
This subprocess call invokes pip to modify the Python environment and is executed from a helper that is called at module import time. That means merely importing this file triggers package installation without user consent, creating unexpected network activity and supply-chain exposure if package resolution is compromised.
- Content
python """专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本""" try: # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错） subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ])
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
This call force-reinstalls setuptools and wheel, mutating core packaging infrastructure as soon as the module is imported. Altering foundational tooling automatically can destabilize the host environment and increases the blast radius of any package-supply-chain issue.
- Content
python "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ]) # 再安装兼容的 setuptools + wheel subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel" ])
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 第一步：尝试 import 检查（最快） try: parts = import_name.split('.') mod = __import__(parts[0]) for part in parts[1:]: mod = getattr(mod, part) if sub_import:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This subprocess call executes a pip install command built from the caller-controlled spec value, supporting arbitrary package names, git URLs, and archive paths. In the context of a MeloTTS metadata generator, this capability is unrelated to the declared function and enables remote code introduction and environment compromise through untrusted dependency sources.
- Content
python cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"]) try: subprocess.check_call(cmd) logger.info(f"✅ {spec} 安装/升级完成！") except subprocess.CalledProcessError as e:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
The fallback installation path executes pip against a local zip archive whose path is supplied at runtime. Installing arbitrary local archives can execute untrusted build/install code and bypass normal dependency review, making this a high-risk code introduction mechanism.
- Content
python sys.executable, "-m", "pip", "install", "--upgrade", fallback_zip, "--verbose" ] subprocess.check_call(cmd_fallback) logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！") return except subprocess.CalledProcessError as e2:
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # ==================== 1. 检查是否已安装 + 版本是否满足 ==================== try: __import__(import_name) # 尝试获取当前版本 try:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
This helper installs an arbitrary package string with optional version constraints at runtime, again mutating the environment from within the skill. Even though it targets PyPI rather than git explicitly, it still expands the trusted computing base and can install unsafe or typosquatted packages outside the skill's stated scope.
- Content
python logger.warning(f"🔧 正在安装 {install_str} ...") try: subprocess.check_call([ sys.executable, "-m", "pip", "install", install_str, "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file's natural-language description and many runtime messages are written only in Chinese, with no indication that the skill is region-specific or that users may select another language. Per the policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def is_torch_gpu_installed(python_exe): """检测虚拟环境中是否安装了 GPU 版本 PyTorch""" try: result = subprocess.run( [str(python_exe), "-c", "import torch; print(torch.version.cuda or 'cpu')"], capture_output=True, text=True, timeout=10
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This bootstrapper performs broad environment setup, GPU probing, and multiple package installations that exceed the manifest's narrowly described role of generating MeloTTS metadata files. Such overbroad behavior is dangerous because it silently mutates the host, adds network/package trust dependencies, and increases the chance that the skill is used as an unexpected installer rather than a simple file-generation tool.
- Content
Static analysis
No suspicious patterns detected.