FreeFM

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 0.1.0-alpha.3

Overview

The skill is mostly coherent, but it asks users to install and later schedule a credential-handling music CLI from an unpinned Git repository.

Review the FreeFM source before installing, or prefer a pinned commit or signed release. Only enable the hourly scheduler after one successful manual preview and sync, and remember that the installed binary will handle your NetEase account session.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:36

Finding

Unpinned Git Repository Used for Source Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 36
Vulnerability Type: Unpinned source dependency
Risk Level: Medium

Vulnerable Code

sh

cargo install --git https://github.com/Yuxin-Qiao/FreeFM --locked --root "$HOME/.local"

Technical Analysis

The installation command retrieves, compiles, and installs FreeFM directly from a personal GitHub repository without specifying an immutable commit through Cargo's --rev option. The --locked flag constrains dependency resolution using the repository's lockfile, but it does not pin the repository's own source revision.

Consequently, the command executed by a user at a later date may build different source code than the version reviewed during this audit. Cargo compilation can also execute package build scripts, so compromise or malicious modification of the upstream repository could result in code execution during installation—not merely when the resulting application is subsequently launched.

The separate helper download documented at SKILL.md:88-102 does not have this defect: it references an immutable commit, downloads to a temporary file, verifies a fixed SHA-256 digest before installation, and does not pipe network content directly into a shell.

Attack Path

1. An attacker compromises the upstream GitHub account or gains permission to modify the FreeFM repository.
2. The attacker changes the repository's default branch, adding malicious Rust code or a Cargo build script.
3. A user follows the documented installation command after granting the requested approval.
4. Cargo retrieves the current, attacker-controlled default-branch source because no commit is pinned.
5. Malicious build logic executes during compilation, or the installed freefm binary executes it during authentication or synchronization.
6. The payload operates with the privileges of the user who invoked Cargo and may access files and credentials available to that acco ...[truncated 679 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation to a reviewed immutable Git commit:

   sh

   cargo install \
     --git https://github.com/Yuxin-Qiao/FreeFM \
     --rev c7bcf10dce142fd85c84f82173a307e91ea99adc \
     --locked \
     --root "$HOME/.local"
   

2. Audit the selected revision, including Cargo.toml, Cargo.lock, build scripts, procedural macros, and transitive dependencies, before publishing the instruction.

3. Update the pinned revision only through a documented review process.

4. Prefer signed release artifacts from a controlled release channel and verify signatures or cryptographic checksums before execution.

5. Preserve the existing requirement for explicit user approval before installation.

6. Where practical, perform compilation in an isolated environment with restricted filesystem and credential access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

Hermes 0.17 may install only `SKILL.md` from a community GitHub/skills.sh

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

## Guardrails

- Work only with the user's own NetEase Cloud Music account.
- Never ask the user to paste `MUSIC_U`, cookies, session files, or QR keys.
- Never print, inspect, summarize, upload, or commit credentials or playback
  URLs.
- Never unlock restricted content, replace audio URLs, download audio, or

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file instructs users to use README.zh-CN.md for installation, recovery, removal, and troubleshooting. This imposes a specific language resource in the skill guidance without user opt-in or an explicit justification that the skill is region- or language-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.