Security Audit
dkyazzentwatwa/chatgpt-skills:audio-converter
github.com/dkyazzentwatwa/chatgpt-skillsTrust Assessment
dkyazzentwatwa/chatgpt-skills:audio-converter received a trust score of 69/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 5 findings: 0 critical, 0 high, 4 medium, and 1 low severity. Key findings include Unpinned Python dependency version, Unmanaged External Dependency (FFmpeg), Arbitrary File System Access.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 24, 2026 (commit d4bad335). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings5
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Python dependency version Requirement 'pydub>=0.25.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | audio-converter/scripts/requirements.txt:1 | |
| MEDIUM | Unpinned Python dependency version Requirement 'soundfile>=0.12.0' is not pinned to an exact version. Pin Python dependencies with '==<exact version>'. | Dependencies | audio-converter/scripts/requirements.txt:2 | |
| MEDIUM | Unmanaged External Dependency (FFmpeg) The skill explicitly relies on an external, unmanaged FFmpeg binary being installed on the system. If a vulnerable version of FFmpeg is present, this skill provides a direct interface to invoke it with user-controlled inputs (file paths, formats, bitrates), potentially allowing an attacker to trigger FFmpeg-specific vulnerabilities (e.g., command injection, arbitrary file read/write, or denial of service through crafted media files). The skill itself does not manage or validate the FFmpeg version, making it a significant supply chain risk. Implement checks for FFmpeg version and known vulnerabilities, or bundle a trusted FFmpeg binary. Alternatively, clearly document the security implications and required secure FFmpeg versions for users. Consider using a library that bundles its own FFmpeg or provides more robust sandboxing for external calls. | Static | SKILL.md:130 | |
| MEDIUM | Arbitrary File System Access The skill allows arbitrary file paths for input (`filepath`, `input_dir`) and output (`output`, `output_dir`) directly from user-controlled arguments (e.g., CLI arguments). This means the skill can read from and write to any location on the file system that the executing user has permissions for. An attacker could potentially use this to read sensitive files (if they can be interpreted as audio by pydub) or write to critical system locations, leading to data exfiltration, data corruption, or privilege escalation, depending on the execution environment's sandboxing. Implement strict path validation and confinement. Restrict input and output directories to a designated sandbox or temporary directory. Use `os.path.abspath` and `os.path.commonprefix` to ensure paths remain within an allowed base directory. Avoid directly using user-provided paths without sanitization. | Static | scripts/audio_converter.py:32 | |
| LOW | Unpinned Dependencies The `requirements.txt` file specifies minimum versions for `pydub` and `soundfile` (e.g., `pydub>=0.25.0`) rather than exact versions. This practice can lead to supply chain risks, as future versions of these libraries might introduce breaking changes, vulnerabilities, or unexpected behavior. While not a critical vulnerability, it reduces the determinism and security posture of the skill. Pin all dependencies to exact versions (e.g., `pydub==0.25.11`). Use a dependency management tool (like `pip-compile` from `pip-tools`) to generate a locked `requirements.txt` file for reproducible builds and to mitigate risks from unexpected updates. | Static | scripts/requirements.txt:1 |
Scan History
Embed Code
[](https://skillshield.io/report/fb0957b335b359e4)
Powered by SkillShield