mp4-to-mp3-extractor

• Outcome: Review
• Latest audit: Jul 3, 2026 · 2:28 PM UTC
• Version: 1.1.8

Overview

This MP4-to-MP3 skill does the advertised conversion, but it also auto-installs Python packages and FFmpeg with limited user control or disclosure.

Install only if you are comfortable with the skill changing Python packages, creating or reusing a virtual environment, downloading dependencies from package indexes, and auto-installing FFmpeg. Prefer reviewing or modifying it so dependencies are pinned, installed only during an explicit setup step, and FFmpeg is preinstalled or user-approved before download.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 92% confidence
• Finding: subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 94% confidence
• Finding: subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel" ])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 97% confidence
• Finding: subprocess.check_call(cmd)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 95% confidence
• Finding: subprocess.check_call([ sys.executable, "-m", "pip", "install", install_str, "-i", "https://pypi.tuna.tsinghua.edu.cn/simple", "--verbose"

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 95% confidence
• Finding: subprocess.check_call(cmd_fallback)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    # if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 79% confidence
• Finding: subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
        logger.info("   自动确认下载中...")
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
        
        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 96% confidence
• Finding: subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions while explicitly instructing shell execution and relying on environment access. This creates a trust gap for users and orchestrators, because the skill can execute local commands despite not transparently declaring that capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented behavior understates materially riskier actions, including automatic network downloads, dependency installation/upgrades, shared virtual environment reuse, and interpreter restrictions. Hidden installation and network activity expands the attack surface and can lead to supply-chain compromise or unexpected system modification under the guise of a simple media conversion skill.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README instructs the agent to handle a remote Douyin URL and download content before extracting audio, which materially expands the skill from local file conversion into network retrieval and potentially unreviewed multi-step automation. This scope creep is dangerous because users and orchestrators may grant broader permissions or attempt unsupported chaining based on documentation, increasing the risk of unauthorized downloads, legal/compliance issues, or abuse of the agent to fetch remote content.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The documentation broadens the skill from local file processing to handling video URLs, implying download behavior not declared in the manifest. This can trigger unexpected network access, content retrieval, and potentially unsafe processing paths that users and policy systems are not expecting.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file implements a broad package-management utility with support for git repositories, remote URLs, local archives, forced reinstalls, and fallback behavior, which is unrelated to the advertised MP4-to-MP3 extraction purpose. This mismatch increases suspicion because it grants the skill capabilities to fetch and execute code beyond what users would reasonably expect.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This section can install arbitrary packages from package indexes, git repositories, URLs, wheels, and zip archives. Because pip installations can execute arbitrary code during build/install time, this is effectively a remote code execution and supply-chain capability that is not justified by a local audio-extraction skill.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The module executes environment-changing package reinstalls at import time, before any explicit user action. Import-time side effects are especially dangerous because simply loading the module can downgrade core tooling, break the host environment, and trigger network/package operations unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill presents itself as a local MP4-to-MP3 converter but also downloads and installs FFmpeg from the network at runtime. That mismatch is security-relevant because users may not expect network access, code retrieval, and executable installation when granting permission to process local files.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatically downloading and installing an external executable is a significant security risk, especially when the skill's core purpose is simple media conversion. If the download source, package, or transport is compromised, the host may run attacker-controlled binaries with the user's privileges.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The documentation advertises a logging system and retention period but does not clearly warn that detailed execution logs are written to disk under the skill directory. In a file-processing skill, those logs may contain local paths, filenames, timestamps, errors, and other sensitive operational metadata that users may not expect to persist.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: Overly broad trigger phrases like everyday language can cause the skill to be invoked in situations the user did not clearly intend. Because this skill can execute commands and write files, accidental invocation increases the risk of unintended local processing or side effects.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: Ambiguous usage guidance around URL handling makes it unclear when the skill may perform network-enabled actions versus local-only conversion. That ambiguity is dangerous because users may unknowingly authorize downloading external content and subsequent processing.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: The skill omits an explicit warning that it will create output directories and write converted files to disk. While expected for a converter, missing disclosure can still lead to unwanted filesystem changes, confusion, or storage/privacy issues when operating on sensitive directories.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The module performs package installation and environment modification automatically without a clear user-facing warning or confirmation. In practice, this creates a stealthy and surprising behavior pattern that reduces user control and makes harmful side effects more likely to occur unnoticed.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script prints absolute local paths for the code directory, root directory, virtual environment, logs, and model storage. While not directly exploitable on its own, this leaks system layout details that may aid an attacker or expose sensitive filesystem structure in logs or shared terminal output.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill silently creates a virtual environment and performs package management operations as part of normal execution, with only implementation logs indicating that behavior. In an agent skill, unexpected environment mutation and network installation are risky because users may not realize the skill will alter the host and fetch code from external sources.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently proceeds with downloading and installing FFmpeg by sending `Y` to the installer, bypassing any meaningful user confirmation. This weakens user consent and increases the risk of unexpected software changes, network activity, and persistence on the system.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.