T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/media_grabber.py:34- Finding
Unverified Runtime Download and Execution of FFmpeg
- Content
View full analysis
- Remediation
View remediation
Security audit
Music Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This skill is an audio recorder, but it also automatically changes the Python environment and downloads executable dependencies without enough user control or integrity checks.
Review this skill before installing. It records all system playback during the requested window, saves audio locally, installs Python packages at runtime, can download FFmpeg automatically, and uses a persistent shared virtual environment. Only use it in an isolated environment with trusted package sources and explicit recording consent.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T08 · Insecure Dependencies
Error
- Location
scripts/ensure_package.py:131- Finding
Unpinned Runtime Dependency Installation Through a Third-Party Package Mirror
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/ensure_package.py:27- Finding
Import-Time Forced Replacement of Foundational Python Packaging Components
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/config.py:30- Finding
Shared Virtual Environment Creates a Cross-Skill Trust Boundary Violation
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/media_grabber.py:80- Finding
Filename Traversal Allows Writes Outside the Selected Output Directory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (53)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text venv/ ENV/ env/ .env # Logs logs/*.log
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README promotes recording system audio and splitting captured music but does not warn about legal, privacy, or consent requirements for recording copyrighted streams, calls, classes, or other sensitive audio. Because the skill is designed specifically to capture whatever the computer is playing, the lack of guardrails materially raises the chance of misuse or unintentional policy violations.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
An undeclared keyboard listener, especially one that hooks ESC for early stop, is an input-monitoring capability that users may not expect from an audio-recording skill. Even if limited in scope, hidden input interception expands surveillance and behavioral risk beyond the stated purpose.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction says “LLM 必须将其一律转换为分钟数,” which imposes a fixed normalization rule using minutes for all users and requests. This is a language/locale handling constraint presented as mandatory behavior without offering user choice or documenting why this unit policy is required.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file implements a generic package installer rather than functionality aligned with music recording and splitting. This mismatch is dangerous because it indicates hidden capability unrelated to user expectations, making unauthorized environment modification and code acquisition harder to detect and easier to misuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module executes package-management actions on import without explicit user warning or confirmation. Silent environment mutation is particularly dangerous in an end-user skill because merely loading the code can trigger privileged changes and code installation paths outside user intent or awareness.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This code can install arbitrary packages from git, direct URLs, wheels, and zip archives, giving the skill the ability to fetch and execute untrusted code. In a music-toolkit skill, this is especially suspicious because such capability is not necessary for recording or splitting audio and materially raises the risk of supply-chain compromise and arbitrary code execution.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python sys.exit(1) # 传递环境变量防止递归 env = os.environ.copy() env["RUNNING_IN_VENV"] = "true" logger.info(f" 当前Python: {sys.executable}")
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file content does not match the declared audio-recording/music-processing purpose of the skill and instead exposes a generic Windows automation overlay component. Capability mismatch is dangerous because it can hide broader automation behavior from reviewers and users, increasing the chance that unrelated or privileged UI automation is bundled under a benign-seeming manifest.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Forcing affirmative input into the FFmpeg installer removes the final user control point and enables unattended installation of external software. This is especially risky because the skill is triggered for benign-seeming audio tasks, so users may not expect binary downloads and installation side effects during execution.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad, natural-language requests such as '帮我录音 5 分钟' and '录制系统声音 5 分钟', which can overlap with ordinary user conversation and cause the skill to activate unintentionally. In this skill’s context, accidental activation can start system-audio recording without clear, explicit consent, increasing privacy, copyright, and compliance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares executable behavior and explicitly instructs shell command construction, but does not restrict permissions or allowed tools. In a skill that can invoke Python and potentially touch environment, shell, and network during dependency/runtime handling, missing scope boundaries increases the blast radius if the skill is misrouted, modified, or abused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description omits a clear warning that all system playback during the recording window will be captured and written to disk. In the context of internal audio loopback, that missing disclosure weakens informed consent and can expose copyrighted, private, or sensitive audio content unintentionally.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad everyday trigger phrases increase the chance that the skill activates on ambiguous user requests and starts capturing system audio unintentionally. Because this skill records all playback during the window and saves it to disk, false invocation can create privacy, consent, and data-retention issues.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger condition relies on generic keywords and does not clearly distinguish system-audio capture from other recording contexts. In a privacy-sensitive skill, ambiguity materially raises the risk of unintended recording and storage of audio not meant to be captured.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module docstring identifies a different skill and purpose than the declared music-toolkit. This discrepancy is a red flag because misleading provenance or repurposed code can conceal unexpected behavior, and in this case that hidden behavior includes package installation features unrelated to the advertised skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Importing this module immediately changes packaging-related libraries in the environment, creating hidden side effects before any explicit function call. Such behavior is dangerous because it silently mutates the host runtime, can break unrelated software, and normalizes privileged environment changes in a user-facing skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically reinstalling or downgrading setuptools and packaging lacks clear disclosure and can unexpectedly alter the host interpreter's package-management state. While framed as compatibility handling, it still creates hidden operational and security risk through silent modification of core tooling.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 89% confidence
- Finding
This subprocess call performs a pip install that modifies the Python environment at runtime. Although it does not invoke a shell directly, it still causes network/package-management side effects and can pull or replace code during skill execution, which is risky in an end-user audio skill and expands the attack surface through dependency tampering or supply-chain compromise.
- Content
python """专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本""" try: # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错） subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ])
Static analysis
No suspicious patterns detected.