purevocals-uvr-automator

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:05 PM UTC
• Version: 1.0.7

Overview

The skill does perform local vocal extraction, but it also automatically modifies Python environments and downloads executable dependencies without tight pinning or verification.

Review before installing. This is not evidence of theft or deliberate malware, but first run can download and execute packages and FFmpeg, modify Python packaging tools, create a persistent shared venv, and cache models/logs. Install only in an isolated environment where network package installation and changes to Python dependencies are acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/purevocals.py:22

Finding

Automatic Unpinned Dependency Installation in the Invoking Python Environment

Content

View full analysis

Vulnerability Details

File Location: scripts/purevocals.py:22-24; scripts/ensure_package.py:35-47, 131-160
Vulnerability Type: Runtime dependency installation with unpinned versions and import-time side effects
Risk Level: High

Vulnerable Code

python

ensure_package.pip("pydub", "pydub","AudioSegment")
ensure_package.pip("ffmpeg-downloader")
ensure_package.pip("audio-separator")

python

def fix_setuptools_for_legacy_packages():
    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])
    except Exception as e:
        logger.info(f"setuptools repair failed: {e}")

fix_setuptools_for_legacy_packages()

python

cmd = [
    sys.executable, "-m", "pip", "install",
    "--upgrade",
    spec,
    "--verbose"
]

if any(keyword in spec.lower() for keyword in ["git+", "://", ".zip", ".whl"]):
    extra_flags = ["--no-build-isolation", "--no-deps", "--use-pep517"]
    try:
        install_idx = cmd.index("install")
        cmd[install_idx+1:install_idx+1] = extra_flags
    except ValueError:
        cmd.extend(extra_flags)
else:
    cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

subprocess.check_call(cmd)

Technical Analysis

Importing ensure_package immediately invokes fix_setuptools_for_legacy_packages(), which modifies the active Python installation by reinstalling packaging, setuptools, and wheel. The main script then installs pydub, ffmpeg-downloader, and audio-separator before env_manager.setup_venv() creates or switches to the intended virtual environment.

Consequently, these package operations run ...[truncated 2282 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all package installation and environment modification side effects from module imports.
2. Create a skill-private virtual environment before importing optional third-party dependencies.
3. Restart the script inside that environment and perform all subsequent package operations using the environment's Python executable.
4. Replace ad hoc runtime installation with a reviewed lockfile containing exact versions and cryptographic hashes.
5. Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
6. Avoid --upgrade, --ignore-installed, and --force-reinstall during normal skill execution.
7. Use a trusted, explicitly configured package repository. If a mirror is required, validate its governance and integrity controls.
8. Review and pin transitive dependencies rather than pinning only direct packages.
9. Fail safely when dependency verification fails instead of continuing with a partially modified environment.
10. Keep the virtual environment inside a skill-specific directory instead of sharing it with unrelated skills.

T08 · Insecure Dependencies

Warning

• Location: scripts/purevocals.py:31

Finding

Automatic Download and Execution of an Unverified FFmpeg Binary

Content

View full analysis

Vulnerability Details

File Location: scripts/purevocals.py:31-48
Vulnerability Type: Unverified third-party executable retrieval and use
Risk Level: Medium

Vulnerable Code

python

if ffdl.ffmpeg_path is None or not os.path.exists(ffdl.ffmpeg_path):
    subprocess.run(
        ["ffdl", "install"],
        input="Y\n",
        text=True,
        check=True
    )

    importlib.reload(ffdl)

ffdl.add_path()
AudioSegment.converter = ffdl.ffmpeg_path

Technical Analysis

When FFmpeg is unavailable, the skill automatically invokes the ffdl install command and confirms the download without user interaction. The resulting executable is added to PATH and assigned as the converter used by pydub.

The skill does not independently verify the downloaded executable's expected version, cryptographic digest, publisher signature, or trusted installation path. In addition, the downloader package itself is installed without a pinned version or hash. This creates a supply-chain trust chain in which both the downloader implementation and its selected remote artifact may change after the skill has been reviewed.

Merely checking that ffdl.ffmpeg_path exists does not establish that the file is authentic or safe. If the downloader package, its remote source, or the delivered artifact is compromised, a substituted executable can run when audio files are decoded or exported.

Attack Path

1. FFmpeg is absent from the system or the downloader reports no valid FFmpeg path.
2. An attacker compromises the unpinned ffmpeg-downloader package, one of its configured download sources, or a delivered binary artifact.
3. The skill invokes ffdl install and automatically approves the download.
4. The compromised executable is written to the downloader-managed location.
5. The skill adds that location to PATH and configures AudioSegment.converter to use the executable.
6. Audio loading or export ...[truncated 766 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a separately provisioned FFmpeg installation from a trusted operating-system package manager.
2. Require an explicit, absolute FFmpeg path and validate that it resolves to an expected regular file.
3. If automatic download is necessary, pin the exact FFmpeg release and platform-specific artifact.
4. Verify a hardcoded or securely distributed SHA-256 digest before making the binary available for execution.
5. Verify publisher signatures where the platform supports signed binaries.
6. Pin and hash the ffmpeg-downloader package and all of its dependencies.
7. Do not add downloader-controlled directories globally to PATH; pass the verified absolute executable path directly.
8. Store downloaded artifacts in a skill-private directory with restrictive permissions.
9. Reject symbolic links, unexpected ownership, writable-by-other permissions, and paths outside the approved directory.
10. Fail closed and provide manual installation instructions if authenticity verification cannot be completed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (42)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 29)May include surrounding context.

text

venv/
ENV/
env/
.env

# Logs
logs/*.log

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs system/package installation, upgrades core Python packaging components, or installs from git/zip/whl/external indexes without declaring that behavior, it introduces significant supply-chain and environment-integrity risk. In an agent environment, hidden dependency installation can fetch untrusted code, modify the host runtime, and expand execution beyond simple audio processing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs system/package installation, upgrades core Python packaging components, or installs from git/zip/whl/external indexes without declaring that behavior, it introduces significant supply-chain and environment-integrity risk. In an agent environment, hidden dependency installation can fetch untrusted code, modify the host runtime, and expand execution beyond simple audio processing.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the skill performs system/package installation, upgrades core Python packaging components, or installs from git/zip/whl/external indexes without declaring that behavior, it introduces significant supply-chain and environment-integrity risk. In an agent environment, hidden dependency installation can fetch untrusted code, modify the host runtime, and expand execution beyond simple audio processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module mutates packaging, setuptools, and wheel at import time, meaning merely loading the module changes core environment state and performs package installation. This is highly dangerous because it is implicit, broad in scope, and can trigger package execution before any explicit user consent or isolation controls are applied.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function explicitly supports installing arbitrary packages from git repositories and local archives, enabling execution of code from remote or local untrusted sources. For an audio vocal-extraction skill, this capability is unjustified and materially increases the attack surface for supply-chain compromise and code execution.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/env_manager.py (reported line 222)May include surrounding context.

python

sys.exit(1)

    # 传递环境变量防止递归
    env = os.environ.copy()
    env["RUNNING_IN_VENV"] = "true"

    logger.info(f"   当前Python: {sys.executable}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares shell/environment execution capability via its documented command path but does not constrain tool scope with explicit permissions or allowed-tools. In an agent setting, this increases the blast radius of prompt injection or accidental invocation because the runtime may permit broader command execution than the skill actually needs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad, everyday requests such as '帮我提取干声' or '去除伴奏', which can cause the agent to invoke shell-backed processing in situations where the user did not intend to run this specific skill. Overbroad triggering is risky here because the skill can execute Python commands and potentially perform environment setup, making accidental invocation more consequential than for a read-only skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill text recommends a Chinese-specific default model, "shibing624-chinese-kenlm-klm", as the default path, while the overall description does not offer the user a language or locale choice. This can create a language/locale policy issue because the skill appears to privilege Chinese usage by default without explicit opt-in or a clearly documented region-specific constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module is a broad package installer that mutates the Python environment, which exceeds the expected scope of a vocal-extraction skill. This mismatch increases risk because users invoking an audio-processing capability would not reasonably expect generalized dependency installation behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

This code invokes pip to reinstall a core packaging library, which mutates the Python environment and executes package installation logic from external package sources. Because it runs automatically as part of a helper module, it creates an unexpected supply-chain and environment-integrity risk even if the package/version is hardcoded.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 30)May include surrounding context.

python

"""专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本"""
    try:
        # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错）
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

Force-reinstalling setuptools and wheel changes core build tooling for the entire environment and can destabilize unrelated software. Triggering this through normal module execution exposes users to unreviewed environment mutation and package-install side effects.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 35)May include surrounding context.

python

"--verbose", "--ignore-installed", "--no-deps", "packaging==26.1"
        ])
        # 再安装兼容的 setuptools + wheel
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel"
        ])

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Calling environment-modifying installation logic during module import violates safe initialization practices and can surprise users or parent applications. It creates hidden side effects, makes review harder, and can trigger network/package execution in contexts that only intended to import helper functions.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 85)May include surrounding context.

python

# 第一步：尝试 import 检查（最快）
    try:
        parts = import_name.split('.')
        mod = __import__(parts[0])
        for part in parts[1:]:
            mod = getattr(mod, part)
        if sub_import:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This subprocess call installs an arbitrary package spec, including support for git URLs, direct URLs, wheels, and local archives. If spec is influenced by skill logic, configuration, or user-controlled input, it can fetch and execute attacker-controlled code during installation, making this a serious supply-chain and remote code execution risk.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 159)May include surrounding context.

python

cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

    try:
        subprocess.check_call(cmd)
        logger.info(f"✅ {spec} 安装/升级完成！")
        
    except subprocess.CalledProcessError as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

Installing a fallback local zip archive still results in execution of package installation/build logic from an untrusted artifact. If an attacker can place or replace that archive on disk, this provides a local code execution path and bypasses remote-source restrictions.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 173)May include surrounding context.

python

sys.executable, "-m", "pip", "install",
                        "--upgrade", fallback_zip, "--verbose"
                    ]
                    subprocess.check_call(cmd_fallback)
                    logger.info(f"✅ 使用本地包 {fallback_zip} 安装成功！")
                    return
                except subprocess.CalledProcessError as e2:

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 261)May include surrounding context.

python

# ==================== 1. 检查是否已安装 + 版本是否满足 ====================
    try:
        __import__(import_name)
        
        # 尝试获取当前版本
        try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

This code performs pip installation of a constructed package spec at runtime, modifying the host environment and potentially introducing unreviewed code. Even though it targets PyPI rather than git, it still creates a supply-chain risk and violates least surprise for an audio-processing skill.

Content

Scanner excerpt · scripts/ensure_package.py (reported line 288)May include surrounding context.

python

logger.warning(f"🔧 正在安装 {install_str} ...")

    try:
        subprocess.check_call([
            sys.executable, "-m", "pip", "install",
            install_str,
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring describing the skill is entirely in Chinese, and later user-facing status/error messages are also emitted only in Chinese. This creates a natural-language locale constraint without user opt-in, which matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/env_manager.py (reported line 57)May include surrounding context.

python

def is_torch_gpu_installed(python_exe):
    """检测虚拟环境中是否安装了 GPU 版本 PyTorch"""
    try:
        result = subprocess.run(
            [str(python_exe), "-c",
             "import torch; print(torch.version.cuda or 'cpu')"],
            capture_output=True, text=True, timeout=10

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 87% confidence

Finding

This code automatically upgrades pip at runtime from the network, changing the execution environment without user approval or version pinning. In a hostile or misconfigured package supply chain scenario, this can introduce unreviewed code into the environment and increase exposure to dependency confusion or malicious package delivery.

Content

Scanner excerpt · scripts/env_manager.py (reported line 96)May include surrounding context.

python

logger.info("虚拟环境创建成功")

        logger.info("正在升级 pip...")
        subprocess.check_call([str(venv_python), "-m", "pip", "install", "--upgrade", "pip"])

    # ==================== 检查 PyTorch GPU 是否已安装 ====================
    if Path(venv_python).exists() and is_torch_gpu_installed(venv_python):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/env_manager.py (reported line 125)May include surrounding context.

python

if nvidia_smi_path:
            try:
                # 运行完整 nvidia-smi 并解析输出
                result = subprocess.run(
                    [nvidia_smi_path],
                    capture_output=True, text=True, timeout=10
                )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

The script performs automatic installation of torch packages from a remote package index at runtime. Even though the index URL is hardcoded to PyTorch infrastructure, executing package installation during skill startup introduces supply-chain risk because arbitrary code in downloaded packages can run during installation and subsequent imports.

Content

Scanner excerpt · scripts/env_manager.py (reported line 170)May include surrounding context.

python

# 安装 PyTorch
        logger.info("正在安装 PyTorch（~2-3GB，请耐心等待）...")
        subprocess.check_call([
            str(venv_python), "-m", "pip", "install", "torch", "torchvision", "torchaudio",
            "--index-url", index_url
        ])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/env_manager.py (reported line 176)May include surrounding context.

python

])

        # 验证
        verify = subprocess.run([
            str(venv_python), "-c",
            "import torch; "
            "print('GPU可用' if torch.cuda.is_available() else '仅CPU'); "

Static analysis

No suspicious patterns detected.