Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward audio-to-MP3 converter with some documentation accuracy issues but no hidden, persistent, credential-seeking, or exfiltrating behavior.
Install only if you are comfortable running a local ffmpeg-based script on music files or directories you choose. Be aware that the documentation overstates metadata and encoding automation, and review output paths before using single-file commands with -y because they can overwrite an existing MP3 destination.
代码的主要用途与描述大体一致，确实是一个将多种音频批量转为 MP3 的 shell 工具，也支持单文件/整目录处理并会检测 ffmpeg 是否安装。因此不存在恶意或完全不同用途的行为。 但描述中的两个关键能力与实现不符：第一，“保留元数据”未在 ffmpeg 命令中通过显式 metadata/map_metadata 参数体现，是否保留取决于 ffmpeg 默认行为，不能认为代码明确实现了该能力；第二，“自动检测 ffmpeg 并选择最优编码参数”里，前半句成立（会检查 ffmpeg 是否在 PATH 中），后半句不成立，因为脚本只是使用 libmp3lame 和可配置的 VBR 质量档位（默认 2），没有根据输入特征自动分析并选择最优编码策略。故应判定为描述与实际行为存在实质性不一致。
The alias list includes generic phrases such as "QQ音乐转换", "OGG转MP3", "FLAC转MP3", "音频转MP3", and especially "audio to mp3", which are broad requests that overlap with common audio-conversion tasks beyond this skill's stated QQ Music focus. Although the document later narrows intended usage, the activation phrases themselves do not include explicit scope constraints or negative examples at the trigger level.
The documentation states as a rule that the skill does not overwrite original outputs and will skip when a same-named MP3 already exists, but the single-file command example includes -y, which forces overwriting existing output files. This is an active contradiction in the skill's own instructions about intended behavior.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
echo "Error: ffmpeg not found in PATH" >&2
echo "Install:" >&2
echo " macOS: brew install ffmpeg" >&2
echo " Ubuntu: sudo apt install ffmpeg" >&2
echo " Windows: download from https://ffmpeg.org/download.html" >&2
exit 1
fi
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
echo "Error: ffmpeg not found in PATH" >&2
echo "Install:" >&2
echo " macOS: brew install ffmpeg" >&2
echo " Ubuntu: sudo apt install ffmpeg" >&2
echo " Windows: download from https://ffmpeg.org/download.html" >&2
exit 1
fi
The command uses ffmpeg -y, which forces overwrite of the destination file if it already exists. Although the script skips when the exact destination already exists earlier, -y still suppresses any user confirmation for replacement behavior and there is no explicit warning in the usage/help text about automatic overwriting.
The script’s title, comments, help examples, and runtime output are written in Chinese, which forces a specific language for users without offering any locale selection. This can violate language/locale policy when skills are expected to be language-neutral or user-selectable.