melo-tts-metadata-creator

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:02 PM UTC
• Version: 1.0.8

Overview

This skill does generate MeloTTS metadata, but it also automatically installs and changes many Python packages and creates a shared virtual environment with limited user control.

Install only if you are comfortable with the skill modifying Python environments, downloading large ML packages/models, probing GPU details, and writing logs/transcripts/metadata locally. Prefer running it in an isolated disposable environment and review the exact input/output paths before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 96% confidence
• Finding: This subprocess invocation performs a pip install that forcibly alters the Python environment. In this file, it runs automatically as part of module initialization and is unrelated to the stated MeloTTS metadata-generation purpose, creating an unjustified supply-chain and environment-tampering risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 96% confidence
• Finding: This call force-reinstalls setuptools and wheel, modifying core packaging components of the runtime. Doing so implicitly on import can break other software, masks supply-chain changes, and exceeds the capabilities expected from a metadata-list generator.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This subprocess call installs arbitrary packages based on the caller-supplied spec, including support for git URLs, local archives, and upgrades. In the context of a skill that should only generate metadata files, this grants broad code-fetching and execution capability and materially increases supply-chain risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 95% confidence
• Finding: This function installs packages from a constructed string with optional version constraints, again modifying the environment at runtime for a skill that should not need package management. Even without shell injection, invoking pip on demand introduces remote code execution through package installation and supply-chain exposure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 97% confidence
• Finding: The fallback installer executes pip against a local zip archive when git installation fails. Installing from local archives still executes untrusted package build/install logic and expands the attack surface, especially since this capability is unnecessary for generating MeloTTS metadata.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 91% confidence
• Finding: This code automatically upgrades pip inside a freshly created environment as part of skill execution, causing unprompted code retrieval and installation from package indexes. In the context of a narrowly scoped metadata-generation skill, autonomous package installation expands the trust boundary and can execute unreviewed code during install hooks or via compromised dependencies.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

• Confidence: 96% confidence
• Finding: The skill installs large third-party packages (`torch`, `torchvision`, `torchaudio`) at runtime based on host probing results. This creates a substantial supply-chain and arbitrary code execution surface during installation, and it is disproportionate to the advertised purpose of generating MeloTTS metadata files.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: Installing `pydub` at runtime introduces additional network dependency retrieval and arbitrary package installation beyond the user's immediate request. Even if common in developer tooling, performing this automatically from skill code increases supply-chain risk and is unnecessary for simple metadata generation unless explicitly justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 89% confidence
• Finding: This automatically installs `huggingface-hub[tqdm]`, which is unrelated or at least broader than the narrow metadata-list generation purpose described for the skill. Runtime dependency expansion increases attack surface and may pull in unnecessary transitive packages or network behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 audio-separator + librosa（你提到的）
        if use_gpu:
            logger.info("安装 audio-separator GPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

• Confidence: 95% confidence
• Finding: This runtime installation of `audio-separator[gpu]` and `librosa` materially exceeds metadata creation and introduces powerful audio-processing packages with significant transitive dependencies. Because installation occurs automatically and conditionally based on hardware, the skill can modify the environment and fetch remote code without clear user consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])

• Confidence: 94% confidence
• Finding: Like the GPU branch, the CPU branch automatically installs `audio-separator[cpu]` and `librosa`, which are beyond the declared metadata-generation scope. Unattended installation from package repositories creates avoidable supply-chain exposure and broadens capability in a way that is inconsistent with least privilege.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill declares no permissions while instructing the agent to invoke Python, read user-supplied files, write output files, and execute shell commands. That mismatch weakens transparency and consent boundaries, making it easier for a user or orchestrator to trigger filesystem and command execution behaviors that were not explicitly permission-gated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is limited to metadata generation, but the observed behavior includes environment creation, hardware probing, package installation, dependency downgrades, and installing unrelated audio packages. This materially expands the attack surface and can modify the host environment in ways the user did not request, including executing networked package installs and changing dependency versions.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The file implements a general-purpose package installer rather than functionality tightly scoped to MeloTTS metadata generation. This mismatch is dangerous because unjustified package-management capabilities create opportunities for environment tampering and supply-chain compromise outside the user's expected trust boundary.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This code accepts arbitrary package specs and installs them via pip, including git repositories and local archives. In a metadata generator, that is an unjustified high-risk capability because package installation can fetch and execute attacker-controlled code and alter the host environment.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module changes the Python packaging environment immediately on import by reinstalling packaging, setuptools, and wheel. Import-time side effects of this magnitude are especially dangerous because they occur without user action, can destabilize the runtime, and violate the principle of least surprise for a metadata-processing skill.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The documentation advertises a smart package installation utility, which conflicts with the skill manifest's narrow MeloTTS metadata purpose. This inconsistency is a security concern because hidden or misdeclared capabilities reduce user awareness and can conceal risky behavior such as dependency installation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill claims to generate `metadata.list` files, but this section installs broad audio-processing and model-hub-related packages unrelated to that core function. Such capability expansion is dangerous because it increases attack surface, enables behavior beyond user expectations, and creates supply-chain risk through unnecessary dependency retrieval.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This file autonomously creates a virtual environment and installs packages during normal execution, which is a strong deviation from a simple metadata-generation utility. Autonomous environment mutation and package installation can execute remote code, alter the host state, and bypass organizational controls on software installation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill probes GPU, driver, and CUDA details using `nvidia-smi`, which is unnecessary for straightforward metadata file generation. This host reconnaissance broadens data collection beyond user expectations and is used to decide what software to install, making the overall behavior more invasive.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The module docstring openly describes an environment bootstrapper that performs version checks, GPU detection, and dependency deployment rather than a narrow metadata creator. This mismatch between stated skill purpose and actual behavior is a security concern because it conceals expanded capabilities and reduces informed user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs package installation at runtime via ensure_package.pip for openai-whisper, torch, and torchaudio. In a skill context, dynamic dependency installation expands behavior beyond simple metadata generation, can trigger arbitrary network access and execution of package install hooks, and makes supply-chain compromise or environment tampering materially more likely.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The chat invocation examples include broad natural-language triggers such as '帮我生成 MeloTTS 的 metadata.list' and similar phrases that can match ordinary user conversation, increasing the chance the skill activates outside a clearly scoped, informed request. In a skill that can recursively scan directories, read local files, and optionally trigger Whisper transcription, accidental invocation can cause unintended processing of user data and file paths.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README states that Whisper can automatically transcribe missing text and download models to './models/' but does not warn that this may perform network access and process potentially sensitive audio content. Users may unknowingly permit external downloads or data handling behaviors, which is risky in an agent context where transparency and consent are important.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill can automatically transcribe audio and download Whisper models to ./models/ when transcripts are absent, but this side effect is not prominently warned to the user. That can trigger unexpected processing of potentially sensitive audio and unexpected local storage or network activity, which is especially risky in a voice-data workflow.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.