Music Toolkit

• Outcome: Review
• Latest audit: Jul 11, 2026 · 11:20 AM UTC
• Version: 1.0.4

Overview

This audio-recording skill has a plausible purpose, but it also performs automatic package/tool installation, environment changes, and global keyboard monitoring with insufficient user control.

Install only if you are comfortable with a skill that can record system audio and modify the local Python environment. Prefer running it in an isolated environment, review the scripts first, and confirm exactly where recordings, logs, virtualenv files, dependencies, and FFmpeg binaries will be written. Clean VirusTotal and static-scan results reduce malware evidence, but the local-impact behavior still warrants careful review.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 91% confidence
• Finding: This code runs pip automatically during module initialization to install or replace Python packages in the host environment. Even though the package name is hardcoded here, it still performs environment mutation and remote package retrieval without explicit user approval, creating supply-chain and integrity risks for any system that imports the module.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 92% confidence
• Finding: This subprocess forcibly reinstalls setuptools and wheel, altering core packaging components of the Python environment. Replacing foundational tooling at runtime can break unrelated software, weaken environment integrity, and expose the host to supply-chain compromise if package sources are tampered with.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# ==================== 后续安装与回退逻辑保持不变 ====================
    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This call executes pip with a command assembled from the caller-controlled spec value, which may reference arbitrary packages, git repositories, direct URLs, wheels, or zip archives. That gives the skill a generic code-fetching and code-installation primitive, enabling remote code execution via malicious packages and broad supply-chain compromise.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 96% confidence
• Finding: This function installs a caller-specified package and optional version constraint via pip with no allowlist or trust boundary enforcement. A malicious or overly broad caller can cause installation of attacker-controlled packages, resulting in arbitrary code execution and unreviewed modification of the host environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 97% confidence
• Finding: The fallback installation path executes pip on a local zip archive whose path is caller-controlled. Installing arbitrary local archives is effectively arbitrary code execution during package build/install, especially dangerous because it broadens the attack surface beyond vetted package indexes to any reachable file path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 🔥 关键：自动输入 Y（默认 yes），彻底无交互
        logger.info("   自动确认下载中...")
        subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
        
        # 下载完后刷新模块
        importlib.reload(ffdl)

• Confidence: 94% confidence
• Finding: The code spawns an external installer process to download and install FFmpeg, then auto-confirms the action by feeding 'Y' without user interaction. Even though the command arguments are not shell-injected, this still creates a supply-chain and unauthorized software installation risk because the skill can fetch and execute external tooling at runtime.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares no permissions while the documented behavior and detected capabilities indicate shell execution, environment access, and likely network activity for dependency/bootstrap steps. This is dangerous because it hides sensitive capabilities from users and policy enforcement, preventing informed consent and allowing code execution or downloads under the guise of a simple audio tool.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose does not match the broader behavior: the skill reportedly includes undeclared overlay UI, keyboard interception/early termination behavior, virtual environment creation, package installation, and FFmpeg download logic. Description-behavior mismatch is dangerous because it conceals execution of additional local code and environment changes that a user would not reasonably expect from an audio recording skill.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a generic package installer unrelated to the declared purpose of recording system audio and AI track splitting. Capability mismatch is dangerous because it indicates hidden or unnecessary power: a music tool should not need broad package-management functionality capable of changing the host environment.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: These lines automatically invoke pip and mutate the environment, including reinstalling packaging components, despite being outside the stated skill purpose. In the context of an audio-recording skill, this hidden installation behavior is especially dangerous because users would not reasonably expect the tool to fetch and install code on import.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This installer accepts external git/HTTP sources and local zip/wheel files, creating a broad code-loading mechanism unrelated to the skill’s audio workflow. Such unrestricted source handling materially increases the chance of malicious package installation, dependency confusion, or execution of attacker-supplied archives.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The documentation identifies a different skill name, 'link-resolver-engine', which does not match the manifest for 'music-toolkit'. This inconsistency is suspicious because mislabeled components can conceal transplanted or repurposed code with capabilities not intended for the current skill.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file’s implementation is materially inconsistent with the declared skill purpose: instead of audio capture and AI track-splitting, it provides a Windows automation overlay that can mask the screen and support long-running automation workflows. In a skill ecosystem, this kind of scope mismatch is dangerous because it can hide unrelated automation behavior from reviewers and users, increasing the risk of deceptive capability smuggling and misuse in broader automation chains.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation advertises emergency termination and safety controls such as ESC or mouse-click abort behavior, but the code does not actually bind those handlers or implement the claimed stop mechanism. This is dangerous because operators may rely on non-existent safety controls during automation, leaving them unable to quickly interrupt execution if the surrounding workflow misbehaves.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script's documented behavior includes auto-installing Python packages and downloading FFmpeg from external sources, which materially expands its capabilities beyond simple audio recording. This increases attack surface through supply-chain compromise, unexpected network access, and execution of untrusted third-party code on the user's machine.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Unattended subprocess-based installation of FFmpeg is broader than necessary for the stated purpose and allows the skill to modify the host environment without meaningful approval at execution time. In the context of an audio tool, silent external installation is especially risky because users would not reasonably expect package management and binary retrieval as part of a recording action.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill invokes pip at runtime to install multiple packages, giving it the ability to fetch and execute arbitrary package installation logic during use. This is dangerous because package installation scripts and dependencies can be compromised, and users invoking an audio feature may not expect network-based code execution or environment modification.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The function starts a global keyboard listener to intercept ESC presses across the system, even though the skill's stated purpose is audio recording and trimming. Global input monitoring expands the privilege and privacy footprint of the skill and creates an unnecessary surveillance-capable primitive that could be repurposed or misused, especially since the manifest does not clearly disclose it.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation examples are broad, common phrases such as '帮我录音 5 分钟' and '录制系统声音 5 分钟', which can cause the skill to trigger during ordinary conversation without sufficiently explicit consent. In the context of a tool that records system audio, unintended activation can capture private calls, meetings, media, or copyrighted content, making accidental invocation materially risky.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The README promotes high-fidelity system-audio recording and AI track splitting but does not provide a clear warning that recording system output may capture sensitive communications or copyrighted material. In this skill's context, the omission increases the chance users unknowingly record meetings, classes, streaming content, or other protected/private audio, creating privacy, compliance, and legal exposure.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger phrases are broad enough to overlap with common user language, increasing the chance the skill activates unintentionally. In this context, accidental activation is more dangerous because the skill can start system-audio recording and write files, creating privacy and consent issues even without malicious intent.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger conditions rely on generic keywords without clearly defining when the skill should or should not run. Because this skill captures system audio in the background, ambiguous invocation materially raises the risk of unintended recording or execution in unrelated conversations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description says recording starts automatically in the background and exports audio, but it does not clearly present this as a user-visible risk or consent-sensitive action. Background system-audio capture can collect private media, meetings, or other sensitive content, so lack of explicit disclosure and confirmation is a meaningful safety issue.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The command instructions directly launch a background recording script without any built-in user-facing warning, approval checkpoint, or runtime notice. In a recording skill, silent execution is especially risky because it can capture sensitive audio and create artifacts on disk before the user understands what will happen.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The module calls fix_setuptools_for_legacy_packages() at import time, so simply importing the file triggers package installation and toolchain modification without warning or consent. Hidden execution on import is especially dangerous in agent skills because normal loading of the skill can unexpectedly perform privileged package-management actions on the host.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.