blog-narrator
Warn
Audited by Snyk on Jul 13, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill downloads ONNX model and token/CMVN files from https://modelscope.cn/models/iic/SenseVoiceSmall-onnx/resolve/master/model_quant.onnx (and the companion tokens.json and am.mvn) at runtime (scripts/narrator_core.py) and then loads/executes the ONNX model via onnxruntime in the match node (scripts/nodes/match.py), so remotely-fetched content is executed and directly affects ASR outputs.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata