Security audit
Security checks for vulnerabilities and agentic risk
The skill is presented as an audio cleaner but ships a broad Yaps CLI adapter that can run other media and account-related workflows, so users should review the scope before installing.
Install only if you are comfortable with this skill using the local Yaps desktop/CLI session and with the packaged adapter being broader than denoising. Keep Yaps updated, review any model downloads or output overwrites before approving them, and do not approve unexpected Keychain prompts or account reconnection requests.
function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}message: "Yaps is signed in, but its trial or Yaps Pro access is not active. Open Yaps to review the available trial or Yaps Pro options; the plugin will pick up the change automatically.",
};
}
if (auth.status === "credential_unavailable" || auth.diagnosticCode === "keychain_unavailable") {
return {
code: "account_status_unsupported",
message: "This installed Yaps helper uses an older credential-based account check. Update Yaps and retry. Do not approve a Keychain prompt or create a separate plugin account.",export const MIN_SAFE_AUTH_STATUS_VERSION = "2.3.124"; const MAX_PROBE_BYTES = 64 * 1024; const MAX_VERSION_BYTES = 4 * 1024; const MAX_PLIST_BYTES = 64 * 1024; const MAX_WINDOWS_SHIM_BYTES = 4 * 1024; const RUNNING_YAPS_PROCESS_NAMES = new Set(["yaps.exe", "yaps_mcp.exe", "yaps_cli.exe"]); // Fixed WMI filter: never interpolate a discovered path into this command.
export const MIN_SAFE_AUTH_STATUS_VERSION = "2.3.124"; const MAX_PROBE_BYTES = 64 * 1024; const MAX_VERSION_BYTES = 4 * 1024; const MAX_PLIST_BYTES = 64 * 1024; const MAX_WINDOWS_SHIM_BYTES = 4 * 1024; const RUNNING_YAPS_PROCESS_NAMES = new Set(["yaps.exe", "yaps_mcp.exe", "yaps_cli.exe"]); // Fixed WMI filter: never interpolate a discovered path into this command.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;Detected: suspicious.dangerous_exec