T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ensure_package.py:26- Finding
Host Python Environment Is Modified Before Virtual-Environment Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
turbo-whisper-local-stt
Security checks for vulnerabilities and agentic risk
Overview
This audio transcription skill mostly matches its purpose, but it quietly performs broad automatic installs and downloads despite presenting itself as local and offline.
Review before installing. Use this only in an environment where automatic pip installs, Hugging Face downloads, model caching, logs, and transcript/audio output files are acceptable. Prefer a sandbox or dedicated virtual environment, provide a local --model_path for offline use, and avoid untrusted --model repository names.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/transcribe.py:27- Finding
Unpinned Dependencies Are Automatically Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/transcribe.py:51- Finding
Arbitrary Remote Model Repositories Are Accepted Without Revision or Integrity Pinning
- Content
View full analysis
str: if model_name in MODEL_MAPPING: repo_id = MODEL_MAPPING[model_name] local_dir = models_dir / model_name.replace("/", "_") elif "/" in model_name: repo_id = model_name local_dir = models_dir / model_name.split("/")[-1].replace(":", "_") else: repo_id = model_name local_dir = models_dir / model_name.replace("/", "_") if local_dir.exists() and any(local_dir.iterdir()): return str(local_dir) local_dir.mkdir(parents=True, exist_ok=True) snapshot_download( repo_id=repo_id, local_dir=str(local_dir), allow_patterns=["*"] ) ``` The repository identifier is supplied through a command-line argument: ```python parser.add_argument( "--model", type=str, default=None, help="Model alias or repository name" ) ``` ### Technical Analysis The `--model` value can identify an arbitrary Hugging Face repository. If the value contains a slash, it is directly assigned to `repo_id`. The download operation does not specify an immutable commit revision and uses `allow_patterns=["*"]`, causing all repository content to be downloaded. As a result: - Repository content can change after the Skill audit. - No cryptographic hash verifies the downloaded model files. - Unrelated or oversized files can be included. - An attacker-controlled repository can provide malformed artifacts targeting vulnerabilities in downstream model parsers. - A mutable trusted repository can become unsafe if its account or release process is compromised. The reviewed code does not prove that model files are directly executed as Python code. The confir ...[truncated 1471 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (51)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text venv/ ENV/ env/ .env # Logs logs/*.log
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill claims to be offline and restricted to audio transcription, but this finding indicates automatic model downloads, runtime dependency installation, audio export, and dataset metadata generation for TTS/training. Those are materially different capabilities that can exfiltrate trust to external services, create additional artifacts, and repurpose user audio into derived training-style datasets without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to be offline and restricted to audio transcription, but this finding indicates automatic model downloads, runtime dependency installation, audio export, and dataset metadata generation for TTS/training. Those are materially different capabilities that can exfiltrate trust to external services, create additional artifacts, and repurpose user audio into derived training-style datasets without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to be offline and restricted to audio transcription, but this finding indicates automatic model downloads, runtime dependency installation, audio export, and dataset metadata generation for TTS/training. Those are materially different capabilities that can exfiltrate trust to external services, create additional artifacts, and repurpose user audio into derived training-style datasets without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill claims to be offline and restricted to audio transcription, but this finding indicates automatic model downloads, runtime dependency installation, audio export, and dataset metadata generation for TTS/training. Those are materially different capabilities that can exfiltrate trust to external services, create additional artifacts, and repurpose user audio into derived training-style datasets without clear consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to be offline and restricted to audio transcription, but this finding indicates automatic model downloads, runtime dependency installation, audio export, and dataset metadata generation for TTS/training. Those are materially different capabilities that can exfiltrate trust to external services, create additional artifacts, and repurpose user audio into derived training-style datasets without clear consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as a local audio-to-text tool, but this file implements a general-purpose package installer that can download and install code from package indexes and git repositories. That mismatch is security-relevant because users and reviewers may grant the skill more trust than warranted, while the hidden capability enables network access and code execution outside the declared purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section gives the skill subprocess execution and automatic pip-based environment modification during import, which is unnecessary for basic local transcription. In the context of a narrowly scoped offline STT skill, this overbroad capability is more dangerous because it permits silent system changes and potential execution of externally sourced installer code with minimal visibility.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This block explicitly supports installing from git+https, remote indexes, wheels, and zip files, directly contradicting the skill's 'completely offline, privacy-safe' positioning. In this context, the discrepancy increases severity because the skill can reach out to external sources and introduce arbitrary third-party code into a supposedly local-only workflow.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code performs network-based package downloads while the skill description repeatedly presents the tool as fully offline, local, and privacy-safe. That discrepancy is security-significant because users may provide sensitive audio under the assumption that no network activity occurs, while the bootstrapper reaches external package repositories and executes downloaded code.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python sys.exit(1) # 传递环境变量防止递归 env = os.environ.copy() env["RUNNING_IN_VENV"] = "true" logger.info(f" 当前Python: {sys.executable}")
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises itself as completely offline and privacy-safe, yet it will automatically download models from Hugging Face when a model is missing. That creates an undisclosed network egress path, undermines user expectations about locality/privacy, and introduces supply-chain exposure through remotely fetched model artifacts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README says the tool has built-in '中文优先优化', which indicates a language preference baked into the skill behavior. The document does not clearly offer users a language choice or opt-in for this locale-specific behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README makes absolute privacy/offline guarantees ('完全本地离线运行', '数据绝对安全') while elsewhere documenting automatic model downloads from Hugging Face. This can mislead users and agents into sending network requests or exposing metadata in environments where offline-only handling is required, creating a trust and disclosure risk even if no direct code execution is shown.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill invokes Python and the embedded command description indicates shell execution plus file writes, yet the manifest does not declare any tool scope or allowed-tools restrictions. This weakens containment and makes it easier for a supposedly simple transcription skill to execute broader system actions than users or the platform may expect.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description states the tool is '中文优先', which imposes a locale/language preference by default. The policy allows language constraints only when users are given a choice or the locale limitation is clearly justified; here, the skill also supports other languages and auto-detection, so defaulting to Chinese preference without opt-in is a natural-language policy issue.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger examples use broad everyday phrases like 'help me transcribe' that may activate the skill without enough assurance that the user actually provided an audio file or intended this specific tool. Over-broad activation can cause unintended shell execution, file writes, or environment changes in contexts where the user only asked a general question.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The main trigger documentation repeats insufficiently scoped colloquial phrases, increasing the chance of accidental invocation. In a skill capable of shelling out to Python and writing files, unintended activation is more dangerous than in a read-only assistant workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The parameter documentation says language is optional and that the system will auto-detect but '默认自动检测但优先中文'. That language indicates a built-in preference for one locale even when the user has not requested it, which conflicts with the policy against forcing a language or locale without user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file header presents this module as part of the STT skill while the actual code is a reusable package-installation utility. Mislabeling functionality is dangerous because it obscures privileged behaviors from auditors and users, making risky capabilities easier to hide within an otherwise benign-seeming skill.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
This import-time subprocess call invokes pip to modify the Python environment automatically, which can fetch and install code without explicit user approval. In a skill advertised as local/offline audio transcription, silently reinstalling packaging at runtime expands the attack surface and enables unreviewed dependency changes or supply-chain compromise.
- Content
python """专门为老项目（使用 pkg_resources 的 setup.py）修复 setuptools 版本""" try: # 先强制修复损坏的 packaging 包（关键！解决无RECORD文件报错） subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ])
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
This code force-reinstalls setuptools and wheel via pip during import, altering the host environment before the skill even runs. That behavior is dangerous because it can break other software, execute installer code from external package sources, and violates the stated local/offline scope of the skill.
- Content
python "--verbose", "--ignore-installed", "--no-deps", "packaging==26.1" ]) # 再安装兼容的 setuptools + wheel subprocess.check_call([ sys.executable, "-m", "pip", "install", "--verbose", "--force-reinstall", "setuptools<=81.2.0", "wheel" ])
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Calling fix_setuptools_for_legacy_packages() at import time means merely importing this module triggers package repair and reinstallation actions automatically. That is dangerous because it performs privileged environment changes without user warning or consent and can execute code from packaging operations unexpectedly.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python # 第一步：尝试 import 检查（最快） try: parts = import_name.split('.') mod = __import__(parts[0]) for part in parts[1:]: mod = getattr(mod, part) if sub_import:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This subprocess call executes pip install using a spec that supports ordinary packages, version specifiers, git+ URLs, and local archives. That gives the skill a generic code-download and code-install capability far beyond audio transcription, creating a serious supply-chain and arbitrary code execution risk if the spec is influenced by skill logic or compromised sources.
- Content
python cmd.extend(["-i", "https://pypi.tuna.tsinghua.edu.cn/simple"]) try: subprocess.check_call(cmd) logger.info(f"✅ {spec} 安装/升级完成！") except subprocess.CalledProcessError as e:
Static analysis
No suspicious patterns detected.