音乐下载工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:36 AM UTC
• Version: 1.0.0

Overview

This is a straightforward music-download skill, with the main caution that its suggested yt-dlp install method is broader than necessary.

Install yt-dlp in an isolated tool environment such as pipx or a virtual environment instead of using `--break-system-packages`, review the download directory before batch downloads, and only download content you are authorized to save.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Dependency Installation into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9–12
Vulnerability Type: Unpinned third-party dependency installation and bypass of Python environment protections
Risk Level: Medium

Vulnerable Code

bash

## Installation
pip install --break-system-packages yt-dlp

Technical Analysis

The installation command retrieves yt-dlp without specifying a reviewed version or verifying an integrity hash. Consequently, the installed code depends on whichever release the package index resolves when the command is executed. This creates supply-chain exposure if a future release, package distribution channel, or transitive dependency is compromised.

The --break-system-packages option bypasses Python's externally managed environment protection. Rather than isolating the dependency, it permits installation into the host Python environment where package upgrades or conflicts can affect other system or user applications. The option does not itself elevate privileges, but it increases the scope of changes under the permissions already held by the invoking user.

Attack Path

1. A user or agent follows the installation command from SKILL.md.
2. pip resolves the latest available yt-dlp package and any required dependencies from its configured package index.
3. If the resolved release, dependency, index, or distribution path has been compromised, attacker-controlled installation or runtime code is downloaded.
4. The package is installed outside an isolated environment because --break-system-packages overrides the environment safeguard.
5. Malicious code can execute with the permissions of the invoking account during installation or when the downloaded tool is subsequently run.

This path depends on compromise or malicious substitution in the dependency supply chain; the audited project does not itself contain an embedded payload.

Impact Assessment

Successful exploitation could permit co ...[truncated 571 chars]

Remediation

View remediation

Remediation Suggestions

• Install the tool in an isolated environment using pipx or a dedicated virtual environment.
• Pin yt-dlp to a specifically reviewed version rather than resolving the latest release dynamically.
• Remove --break-system-packages to preserve Python's externally managed environment protections.
• Where installation is performed through pip, use a reviewed requirements file with cryptographic hashes and the --require-hashes option.
• Review and update the pinned version through a controlled dependency-update process.

Example using pipx:

bash

pipx install yt-dlp==REVIEWED_VERSION

Example using an isolated virtual environment and hash verification:

bash

python3 -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

The corresponding requirements.txt should contain an exact reviewed version and trusted SHA-256 hashes for every resolved distribution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill description and instructions are written in Chinese, and the file does not indicate that Chinese is optional or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file gives multiple commands that download media and save output under user-specified paths, which affects local user data. Although the commands make file output visible, the skill description does not explicitly warn users that it will create files on disk or may overwrite/accumulate content in the target directory.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.