purevocals-uvr-automator

• Outcome: Review
• Latest audit: Jul 9, 2026 · 2:02 PM UTC
• Version: 1.0.7

Overview

This audio tool appears purpose-built, but it automatically changes Python environments and downloads software without clear user approval.

Install only if you are comfortable with it creating a Python environment, downloading large ML/audio packages and models, installing ffmpeg tooling, and potentially changing the Python environment used to launch it. Prefer running it in an isolated environment or container, and review the input/output paths carefully before allowing recursive folder processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

• Confidence: 94% confidence
• Finding: This code performs package installation at import/runtime and modifies the Python environment automatically. Even though the package name is hardcoded here, invoking pip from the skill changes the host environment and introduces supply-chain risk if package indexes, dependency resolution, or execution context are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

• Confidence: 95% confidence
• Finding: This force-reinstalls setuptools and wheel, altering core packaging infrastructure of the host Python environment. Changing foundational packaging tools at runtime can break other software, bypass expected dependency controls, and expands the blast radius well beyond the declared audio-processing purpose.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# 第一步：尝试 import 检查（最快）
    try:
        parts = import_name.split('.')
        mod = __import__(parts[0])
        for part in parts[1:]:
            mod = getattr(mod, part)
        if sub_import:

• Confidence: 79% confidence
• Finding: The function dynamically imports a module name derived from parameters, which can trigger execution of attacker-controlled code if import targets are influenced upstream or shadowed on sys.path. In this file it is used as part of a generic installer/checker, making the behavior broader and less predictable than a fixed import list.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: This executes a pip install command built from the caller-supplied spec, which supports arbitrary PyPI names, git URLs, and archive paths. That is effectively a generic code acquisition and execution mechanism unrelated to simple vocal separation, and it creates a direct supply-chain/RCE path if any upstream input can influence spec.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# ==================== 1. 检查是否已安装 + 版本是否满足 ====================
    try:
        __import__(import_name)
        
        # 尝试获取当前版本
        try:

• Confidence: 74% confidence
• Finding: This dynamically imports a package name passed into a helper, again causing import-time code execution from a variable target. While intended for install detection, it still broadens attack surface and can load malicious local modules if names are influenced or path shadowing exists.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

• Confidence: 97% confidence
• Finding: This helper installs a package string assembled from variable input, enabling uncontrolled dependency retrieval and execution. Even with a PyPI mirror, arbitrary package installation is dangerous in an agent skill because package setup/build steps can execute code and the behavior is not tightly scoped to the advertised function.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

• Confidence: 98% confidence
• Finding: The fallback path installs a local zip archive as a package, which can execute arbitrary code from attacker-controlled or untrusted local content. Because the path is variable and intended as a fallback, it expands the attack surface to local file planting and trojaned archives with little validation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

• Confidence: 90% confidence
• Finding: The script automatically upgrades pip in a freshly created virtual environment without explicit user confirmation. This grants the skill the ability to fetch and execute remote package-installation code during startup, expanding trust beyond local vocal-processing functionality and increasing supply-chain risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

• Confidence: 94% confidence
• Finding: This code installs large, security-sensitive packages from a remote package index at runtime based on environment detection. If the index, dependency resolution, or selected packages are compromised, the skill can execute attacker-controlled code during installation, making this a meaningful software supply-chain exposure.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: Installing pydub at runtime from external repositories adds another unaudited supply-chain dependency during skill execution. In this context, the danger comes from automatic remote code retrieval and installation rather than the subprocess call syntax itself.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])
        
        logger.info("✅ 虚拟环境及所有依赖安装完成！")

• Confidence: 88% confidence
• Finding: This automatic installation of huggingface-hub from remote repositories increases supply-chain exposure and broadens the skill's network-enabled capabilities without prompting the user. The risk is especially relevant because package installation executes arbitrary setup/build logic in the local environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 安装 audio-separator + librosa（你提到的）
        if use_gpu:
            logger.info("安装 audio-separator GPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

• Confidence: 93% confidence
• Finding: Installing audio-separator[gpu] and librosa dynamically from external sources is a real supply-chain risk because package installation can execute code locally and pulls in a wide dependency graph. Given the skill's consumer-facing automation context, doing this automatically on first run makes the behavior more dangerous than a manual, documented setup step.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[gpu]", "librosa"])
        else:
            logger.info("安装 audio-separator CPU 版 + librosa...")
            subprocess.check_call([str(venv_python), "-m", "pip", "install", "audio-separator[cpu]", "librosa"])

        subprocess.check_call([str(venv_python), "-m", "pip", "install", "pydub"])
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "huggingface-hub[tqdm]"])

• Confidence: 93% confidence
• Finding: The CPU variant performs the same kind of unattended remote package installation as the GPU branch, with similar supply-chain exposure. Even though the package choice differs, the underlying risk remains that unreviewed third-party code is downloaded and executed automatically.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill invokes shell commands and depends on Python execution, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: the agent may run code or access environment capabilities without an explicit permission boundary, making review and runtime restriction harder.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The module mutates packaging components and installs dependencies in ways that are broader than the stated audio-processing purpose. Capability/intent mismatch is a strong risk signal for agent skills because it grants system modification powers that are unnecessary for normal vocal-separation tasks.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This function is a generic package installer that accepts arbitrary package specs, git URLs, and local archives, far exceeding what an audio-separation skill should need. In an agent context, such a primitive can be repurposed to fetch and execute arbitrary code, making the skill materially more dangerous than its manifest suggests.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Installing from a local zip fallback allows execution of arbitrary package contents from the filesystem, which is especially risky in shared or user-writable environments. This is not justified by the declared workflow and creates a straightforward path for local code execution via package planting.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The bootstrapper performs broad package installation from external repositories, including heavyweight ML and audio dependencies, even though the advertised function is local audio processing. This creates a substantial and avoidable supply-chain attack surface because dependency installation can execute arbitrary code and introduces network activity not strictly bounded to the user's immediate task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script automatically installs Python packages and prepares execution dependencies at runtime, which introduces supply-chain risk outside the stated core audio-processing function. If a dependency source is compromised or a package version changes unexpectedly, running the skill can execute untrusted code on the host.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code automatically downloads and installs ffmpeg from external sources during normal execution, then adds it to PATH for subsequent processing. This exposes the host to supply-chain compromise and silent execution of newly downloaded binaries without prior validation or user approval.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The README states that models may be downloaded automatically, but it does not prominently warn users that the skill may initiate network access and fetch executable model artifacts during operation. Silent or unexpected downloads can violate user expectations, bypass restricted environments, and increase supply-chain risk if model sources or integrity checks are not clearly documented.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are very broad and overlap with common audio-editing requests, increasing the chance the skill is auto-invoked in situations the user did not specifically intend. Because this skill can execute local code and process files recursively, overbroad activation expands the attack surface and can lead to unintended file operations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script creates a virtual environment, upgrades pip, and later re-executes the main script automatically without an explicit warning or consent prompt. This is dangerous because users may not realize the skill is modifying the system state, downloading code, and restarting execution, which undermines informed trust and safe deployment practices.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script installs packages and performs environment setup automatically without a clear upfront warning or user confirmation. In a skill context, this is dangerous because a user may expect audio processing, not host modification and execution of newly fetched code.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code silently confirms and installs ffmpeg during execution, which modifies the environment and executes external tooling without explicit consent. In an automation skill, that expands the action scope beyond user expectations and increases the chance of unsafe host changes.

Static analysis

No suspicious patterns detected.