T09 · Insecure Skill Coding Practices
Error
- Location
web/app.py:42- Finding
Arbitrary File Overwrite and Deletion Through Unsanitized Upload Filename
- Content
View full analysis
- Remediation
View remediation
Security audit
Local LRC Editor 专业LRC歌词创作工具
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real LRC lyric editor, but its unauthenticated network service exposes unsafe upload handling and a shutdown endpoint.
Review carefully before installing. Run it only in a trusted local environment, preferably bound to localhost rather than all interfaces, and avoid using it on shared or privileged accounts until the upload path handling, shutdown route, dependency pinning, and resource limits are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
web/app.py:63- Finding
Unauthenticated Network-Accessible Service Shutdown
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
web/app.py:22- Finding
Unauthenticated Audio Processing Enables Resource Exhaustion
- Content
View full analysis
num_points: samples = samples[::len(samples)//num_points][:num_points] # 归一化 samples = samples / np.max(np.abs(samples)) return { 'duration': audio.duration_seconds * 1000, 'waveform': samples.tolist(), 'sample_rate': audio.frame_rate } except Exception as e: return {'error': str(e)} ``` ```python @app.route('/upload', methods=['POST']) def upload_file(): if 'file' not in request.files: return jsonify({'error': '没有选择文件'}), 400 file = request.files['file'] if file.filename == '': return jsonify({'error': '没有选择文件'}), 400 if file and allowed_file(file.filename): temp_path = os.path.join(app.config['UPLOAD_FOLDER'], file.filename) file.save(temp_path) waveform = get_waveform_data(temp_path) os.unlink(temp_path) return jsonify(waveform) return jsonify({'error': '不支持的文件格式'}), 400 ``` ```python app.run(host='0.0.0.0', port=698, debug=False) ``` ### Technical Analysis The 100 MB request limit controls only the encoded upload size. It does not constrain decoded duration, sample count, channel count, sample width, memory expansion, FFmpeg processing time, or concurrent requests. `AudioSegment.from_file()` decodes the uploaded media, after which `get_array_of_samples()` and ` ...[truncated 1514 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
start_server.py:6- Finding
Mutable Dependencies Are Installed Automatically at Runtime
- Content
View full analysis
=2.3.0 pydub>=0.25.1 numpy>=1.24.0 ``` ### Technical Analysis When a required module is unavailable, application startup invokes pip and installs a package by its bare name. No exact version, package hash, lockfile, trusted index URL, or artifact signature is enforced. The startup script does not use `web/requirements.txt`; therefore, even its minimum-version constraints do not govern the actual automatic installation. The constraints themselves are open-ended and permit future versions that were not part of this audit. Pip uses the environment's configured package indexes and can download and execute package installation logic. Consequently, application startup behavior depends on mutable external repository state and local pip configuration rather than a reproducible, reviewed dependency set. ### Attack Path 1. One of the three modules is absent from the Python environment. 2. A user runs `start_server.py`. 3. The script invokes `python -m pip install` with only the package name. 4. Pip resolves the package from its configured index and selects the currently available version. 5. If the index, package release, dependency chain, DNS/proxy configuration, or pip configuration ha ...[truncated 628 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
web/templates/index.html:7- Finding
Third-Party Browser Scripts Are Loaded Without Integrity Verification
- Content
View full analysis
``` ### Technical Analysis The page loads executable JavaScript directly from a third-party CDN. Although explicit package versions and HTTPS URLs are used, the script elements do not specify Subresource Integrity hashes. The application also does not establish a restrictive Content Security Policy in the reviewed code. The browser therefore trusts whatever content the CDN returns for those URLs at page-load time. A compromise of the CDN, package distribution account, or delivery path could alter the effective client-side code without modifying the audited Skill files. Because the scripts execute in the application's origin, injected code would have the same browser privileges as the legitimate frontend. It could read application DOM content and local storage, modify exports, send network requests, or invoke the local `/shutdown` endpoint. ### Attack Path 1. An attacker compromises the CDN response, associated package distribution, or another part of the remote delivery chain. 2. A user opens the application page. 3. The browser requests the two JavaScript resources from the CDN. 4. Because no integrity hash is supplied, the browser executes the returned content without checking it against an audited digest. 5. The modified script executes in the `http://localhost:698` or corresponding service origin. 6. The script accesses locally stored lyrics, alters application behavior, or invokes backend endpoints available to that origin. ### Impact Assessment Successful exploitation grants attacker-supplied JavaScript access to the web application's browser origin. This includes lyrics ...[truncated 357 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill description materially overstates implemented functionality while omitting an extra shutdown capability, which is a trust and security problem in agent-distributed skills. Users may expose files, run the service, or rely on data-handling guarantees that do not exist, and the undocumented shutdown endpoint widens the attack surface beyond the declared purpose.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The
/shutdownroute allows any requester to terminate the entire Flask process with no authentication, authorization, or local-only restriction. For an LRC editing service, remote process termination is unnecessary to core functionality and creates an easy denial-of-service condition for anyone who can reach the port.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Exposing a visible 'close service' control in an LRC editor introduces an operational capability unrelated to the tool's editing purpose. This increases the attack surface by advertising a backend termination path that can be abused for denial of service if the shutdown endpoint is reachable without strong authorization.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The client issues a POST request to /shutdown, enabling backend termination from browser-accessible code. In context, this is dangerous because an LRC editor should not let ordinary page interactions stop the service; if server-side controls are weak, this can become a trivial denial-of-service vector.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill documentation instructs users to run a Python server that can install dependencies and use shell-level execution, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, undocumented shell capability increases the chance of unintended command execution and makes risk review, policy enforcement, and user consent weaker.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. The entire skill description and invocation guidance are presented only in Chinese, and the file does not indicate that the user may choose another language or that the skill is intentionally limited to a Chinese-language audience.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Automatically installing Python packages on startup exceeds what a user would reasonably expect from an LRC editing tool and causes code from external repositories to be fetched and executed implicitly. This creates a supply-chain attack surface and can alter the host environment without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script installs packages via pip without meaningful upfront consent, only emitting status messages as it proceeds. Users may not realize the tool will download and execute third-party package installation logic, which increases risk to the local environment and reduces transparency.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The script invokes pip in a subprocess to install packages at runtime. While the package names are hard-coded and there is no shell injection here, dynamically modifying the Python environment during startup introduces supply-chain and integrity risk, especially if package indexes, dependency resolution, or network paths are compromised.
- Content
python def install_package(package): """安装Python包""" subprocess.check_call([sys.executable, "-m", "pip", "install", package]) def check_dependencies(): """检查并安装依赖"""
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill is presented as a lyric authoring web tool, but this file uses subprocess execution to run pip and launch another Python process. Spawning subprocesses is a powerful capability that is not mentioned in the manifest and is not inherently part of LRC editing functionality.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print("访问地址: http://localhost:698") print("按 Ctrl+C 停止服务") subprocess.run([sys.executable, "app.py"])
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This endpoint performs a destructive action solely via an unauthenticated POST request, so any local or remote party with network access can stop the service instantly. Even if intended as a convenience feature, exposing process termination through the application interface materially weakens availability and may also be triggerable by cross-site requests if the service is used from a browser.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The page declares zh-CN as the document language and presents the title and interface text in Chinese, with no indication that language selection is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The page loads executable JavaScript directly from third-party CDNs, which expands trust beyond the stated local lyric-editing scope. If the CDN, dependency, or delivery path is compromised, arbitrary script can execute in the app context and access local lyric data, browser storage, and UI actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code automatically stores the user's lyric data and uploaded file name in browser localStorage, which persists across sessions and may expose creative content or metadata to other users of the same browser profile. There is no visible notice in the UI, comment, or other user-facing disclosure that imported or edited data will be retained locally.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
For markdown files, missing-warning findings apply when the description omits warnings about behaviors affecting user data or privacy. The document advertises automatic saving to browser local storage, but only later mentions recovery behavior; it does not upfront warn that edited lyric content remains stored locally on the device/browser.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script's natural-language strings and comments are consistently in Chinese, including operational output shown to the user. Under the policy, forcing a specific language without opt-in can be a locale/language policy violation unless the restriction is clearly justified or optional.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file includes Chinese-only natural-language strings in comments, docstrings, and API error/status messages such as '没有选择文件' and '服务已关闭'. This enforces a specific language for user-visible behavior without any opt-in, language selection, or justification that the skill is intentionally region-specific.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to resolve to different Flask versions over time. This weakens reproducibility and makes it impossible to verify whether deployed versions include known security fixes or newly introduced vulnerable releases.
- Content
text flask>=2.3.0 pydub>=0.25.1 numpy>=1.24.0
Unverifiable Dependency: flask has 10 known advisory(ies) (CVE-2025-47278 (Flask uses fallback key instead of current signing key); CVE-2018-1000656 (Flask is vulnerable to Denial of Service via incorrect encoding of JSON data); CVE-2019-1010083 (Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory u) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Flask has known advisories, and because the manifest does not pin an exact version, there is no reliable way to determine whether the installed package is affected. For a Flask-backed web skill exposed on a network port, this uncertainty increases operational risk because deployment may resolve to an insecure version.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Using pydub with only a minimum version makes builds non-deterministic and can pull in different versions across environments. While this is primarily a supply-chain hygiene issue, it can expose deployments to unreviewed or vulnerable upstream releases.
- Content
text flask>=2.3.0 pydub>=0.25.1 numpy>=1.24.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The unpinned numpy requirement permits installation of any version at or above 1.24.0, preventing reliable verification of security posture and behavior. In practice, this can lead to inconsistent environments and accidental exposure to vulnerable or incompatible releases.
- Content
text flask>=2.3.0 pydub>=0.25.1 numpy>=1.24.0
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
NumPy has multiple published advisories, and the unpinned requirement means the actual installed release cannot be verified from this file alone. Although numpy is not typically the primary attack surface in this application, unverifiable versions still create avoidable supply-chain and maintenance risk.
- Content
Static analysis
No suspicious patterns detected.