中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 25/100
Last scan:1 day ago Rescan
25 /100
Audio-Segmenter
智能音频切片工具，支持单文件或文件夹递归切片，自动处理ffmpeg依赖，保留原目录结构
Audio-slicing skill with legitimate audio-processing functionality but with undeclared ffmpeg dependency and unpinned pip installations that pose minor supply-chain and documentation-mismatch risks.
Skill NameAudio-Segmenter
Duration43.0s
Enginepi
✓
Safe to install
Declare ffmpeg as a required binary in SKILL.md metadata, pin dependency versions, and consider removing the large commented-out PyTorch/GPU installation block to reduce supply-chain risk surface.

Findings 4 items

Severity Finding Location
Medium
Undeclared ffmpeg binary dependency Doc Mismatch
SKILL.md metadata.bins only declares 'python', but audio_slicer.py silently downloads and installs ffmpeg (100-200MB) via ffmpeg-downloader from third-party sites (gyan.dev, johnvansickle, evermeet.cx). This is a doc-to-code mismatch.
subprocess.run(["ffdl", "install"], input="Y\n", text=True, check=True)
→ Add ffmpeg to metadata.bins in SKILL.md or document the auto-download behavior explicitly.
 scripts/audio_slicer.py:54
Medium
Unpinned dependency installations from third-party mirrors Supply Chain
ensure_package.py installs 'pydub' and 'ffmpeg-downloader' without version constraints from the Chinese mirror pypi.tuna.tsinghua.edu.cn, exposing users to dependency confusion and typosquatting attacks.
subprocess.check_call([sys.executable, "-m", "pip", "install", "--upgrade", pip_pkg, "-i", "https://pypi.tuna.tsinghua.edu.cn/simple", "--quiet"])
→ Pin exact versions (e.g., pydub==0.25.1) and consider using the primary PyPI index or a trusted mirror.
 scripts/ensure_package.py:35
Low
Inactive but present large dependency-installation code block Supply Chain
env_manager.py contains ~100 lines of commented-out code (lines 50-150) that, if uncommented, would install PyTorch (~2-3GB), audio-separator, librosa, and huggingface-hub via unpinned pip from dynamic PyTorch URLs based on GPU detection.
# if Path(venv_python).exists() and is_torch_gpu_installed(venv_python): ...
→ Remove or replace commented-out block with a requirements.txt to prevent future misuse.
 scripts/env_manager.py:50
Low
README.md Python version mismatch with code Doc Mismatch
README.md states 'Python 3.8+' in badge but env_manager.py enforces 3.10~3.12 via check_python_version(), creating a minor doc mismatch.
Python-3.8%2B-green.svg
→ Update README.md Python version badge to 3.10+.
 README.md:4
ResourceDeclaredInferredStatusEvidence
Shell WRITE WRITE ✓ Aligned audio_slicer.py:54 subprocess.run
Filesystem WRITE WRITE ✓ Aligned audio_slicer.py:85 makedirs, export calls
Network NONE READ ✗ Violation ensure_package.py:50 downloads from pypi.tuna.tsinghua.edu.cn; ffdl install down…
Environment NONE READ ✓ Aligned env_manager.py:89 checks RUNNING_IN_VENV; env_manager.py:39 checks Python versio…
8 findings
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/License-Apache%202.0-blue.svg
README.md:3
🔗
Medium External URL 外部 URL
https://opensource.org/licenses/Apache-2.0
README.md:3
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/Python-3.8%2B-green.svg
README.md:4
🔗
Medium External URL 外部 URL
https://www.python.org/
README.md:4
🔗
Medium External URL 外部 URL
https://img.shields.io/badge/OpenClaw-Skill-orange.svg
README.md:5
🔗
Medium External URL 外部 URL
https://pypi.tuna.tsinghua.edu.cn/simple
scripts/ensure_package.py:50
🔗
Medium External URL 外部 URL
https://download.pytorch.org/whl/cpu
scripts/env_manager.py:148
🔗
Medium External URL 外部 URL
https://download.pytorch.org/whl/
scripts/env_manager.py:161

File Tree

8 files · 29.0 KB · 676 lines
Python 5f · 557L Markdown 2f · 75L Ignore 1f · 44L
├─ ▾ 📁 scripts
│ ├─ 🐍 audio_slicer.py Python 142L · 5.9 KB
│ ├─ 🐍 config.py Python 52L · 2.1 KB
│ ├─ 🐍 ensure_package.py Python 73L · 2.8 KB
│ ├─ 🐍 env_manager.py Python 235L · 10.4 KB
│ └─ 🐍 logger_manager.py Python 55L · 2.6 KB
├─ 📄 .gitignore Ignore 44L · 735 B
├─ 📝 README.md Markdown 44L · 2.8 KB
└─ 📝 SKILL.md Markdown 31L · 1.7 KB

Dependencies 3 items

PackageVersionSourceKnown VulnsNotes
pydub unpinned pypi.tuna.tsinghua.edu.cn No Installed without version constraint
ffmpeg-downloader unpinned pypi.tuna.tsinghua.edu.cn No Installed without version constraint; downloads ffmpeg from gyan.dev/johnvansickle/evermeet.cx
ffmpeg unpinned third-party binary sites (gyan.dev, johnvansickle, evermeet.cx) No Not declared in SKILL.md; silently downloaded as binary

Security Positives

✓ No credential theft or sensitive data access observed
✓ No obfuscation (no base64, eval, or anti-analysis techniques)
✓ No network exfiltration or C2 communication detected
✓ No access to ~/.ssh, ~/.aws, .env, or other sensitive paths
✓ No reverse shell, RCE, or persistence mechanisms
✓ Virtual environment isolation (venv) is a positive security practice
✓ Core functionality (audio slicing with pydub) is genuine and matches stated purpose