T09 · Insecure Skill Coding Practices
Error
- Location
scripts/stream_play.py:158- Finding
WebSocket TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
minimax-tokenplan-tts
Security checks for vulnerabilities and agentic risk
Overview
This MiniMax text-to-speech skill is coherent in purpose, but it handles API credentials unsafely and weakens secure network protections.
Review before installing. Do not paste a real MiniMax API key into SKILL.md or the Python files; use an environment variable or secret store instead. Avoid streaming mode until TLS verification is fixed, and do not use custom base URLs unless you fully trust the endpoint. Treat any text sent to this skill as being transmitted to a third-party TTS service.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate.py:135- Finding
API Credentials and User Text Can Be Sent to an Arbitrary Endpoint
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Initialization Instructions Require API Keys to Be Stored in Plaintext Source Files
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:81- Finding
Voice Selection Workflow Requests Unnecessary Access to Agent Identity Data
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Runtime Dependencies Are Installed Without Reproducible Version or Integrity Controls
- Content
View full analysis
=2.28.0 websockets>=12.0 ``` The installation instructions in `SKILL.md` are: ```bash pip3 install requests pip3 install websockets ``` ### Technical Analysis The requirements use open-ended lower bounds, and the documentation installs the latest available versions directly from the configured package index. No lock file, exact version, artifact hash, or trusted-index restriction is provided. The package names observed are legitimate and no malicious package is proven to be present. However, the current configuration allows future, unaudited releases to be selected automatically, reducing reproducibility and expanding exposure to compromised package releases or package-index accounts. Because imported Python packages execute code in the local process context, dependency compromise can affect all data and privileges available to the Skill process. ### Attack Path 1. A future permitted package release or its package-index publisher account is compromised. 2. A user follows the installation instructions or recreates the environment. 3. The package manager selects the newest version satisfying the open-ended constraint. 4. Malicious package installation hooks or imported runtime code execute locally. 5. The compromised dependency can access the TTS process environment, including the API key, user text, network access, and writable files available to the process. ### Impact Assessment A compromised dependency would run with the same operating-system privileges as the user invoking the Skill. It could potentially read environment variables, capture the API key and TTS text, modify files accessible to the process, and make network requests. No current dependency compromise was establi ...[truncated 100 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (19)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These initialization steps tell the operator to place the real API key into two scripts and a visible configuration section, with no warning against plaintext secret storage. This materially increases the risk of secret leakage and unauthorized API use because the credential is replicated across multiple human-readable locations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code explicitly disables TLS certificate verification by setting check_hostname=False and verify_mode=ssl.CERT_NONE for the WebSocket connection. This allows machine-in-the-middle interception or modification of the TTS stream and API traffic, including exposure of the bearer token and tampering with returned audio data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description advertises external API use, WebSocket streaming, and file output, but does not clearly warn users that submitted text will be transmitted to a third-party service and may be saved locally. In a TTS context, this can expose sensitive user content or create privacy surprises, especially when streaming is preferred by default.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger guidance is extremely broad and says this skill should be preferred for essentially any TTS-related phrasing. While not a direct code-execution flaw, overly broad activation can cause the agent to invoke a networked, file-writing skill in situations where the user did not clearly consent to external processing or persistent output.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md - **websockets 库**：`pip3 install websockets`（流式播放需要） - **ffplay**（流式播放需要）： - macOS: `brew install ffmpeg` - Ubuntu: `sudo apt install ffmpeg` - Windows: 从 https://ffmpeg.org/download.html 下载 - 如果 ffplay 未安装，`stream_play.py` 会提示安装方法
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
python - **websockets 库**：`pip3 install websockets`（流式播放需要） - **ffplay**（流式播放需要）： - macOS: `brew install ffmpeg` - Ubuntu: `sudo apt install ffmpeg` - Windows: 从 https://ffmpeg.org/download.html 下载 - 如果 ffplay 未安装，`stream_play.py` 会提示安装方法
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The initialization workflow directs the agent/operator to collect the user's API key and persist it in multiple files, including scripts and documentation. Persisting secrets in plaintext across the workspace broadens the attack surface and makes later disclosure through shared directories, backups, or repository sync more likely.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the operator to hardcode the MiniMax API key and base URL into multiple scripts, despite the manifest already declaring environment-based secret handling. Embedding credentials in source files increases the chance of accidental disclosure through version control, logs, backups, screenshots, or later reuse by other users of the workspace.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The configuration table explicitly instructs replacing a placeholder with the actual API key, encouraging plaintext retention in the markdown file itself. A markdown file is especially easy to inspect, copy, sync, or commit accidentally, making credential compromise more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script transmits arbitrary user-supplied text to a third-party TTS service, but it provides no explicit consent prompt, privacy notice, or redaction safeguards before sending potentially sensitive content off-host. In a skill context, users may assume local processing, so secrets, personal data, or confidential prompts could be exposed to the remote provider unintentionally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
The code performs an outbound HTTP request containing the full input text and an authorization token, which creates a real data exfiltration path to an external service. This is expected for a cloud TTS wrapper, but it remains security-relevant because users may pass confidential content and the '--base-url' override can redirect data to an unintended endpoint.
- Content
python # 发送请求 try: resp = requests.post( f"{base_url}/v1/t2a_v2", headers={ "Authorization": f"Bearer {api_key}",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
User-facing usage text, help descriptions, and operational messages are presented in Chinese only, and the example input text is also Chinese. There is no indication that the tool is region-specific or that users can opt into another language, which conflicts with the policy against forcing a specific language without user choice.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def start_ffplay(): """启动 ffplay 子进程，从 stdin 读取音频数据播放""" try: process = subprocess.Popen( [ "ffplay", "-nodisp", # 不显示窗口
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing natural-language content in Chinese for multiple changelog entries, but there is no indication that the skill is intentionally region-specific or that users can choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
Substantial setup and usage guidance is written only in Chinese, which effectively imposes a language requirement on operators without stating that the skill is Chinese-only or offering an alternative language. Under the policy, forced language/locale constraints should be either optional or clearly documented and justified.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is specified with a minimum version bound only, which makes builds non-reproducible and allows different environments to install different upstream releases. This can unintentionally introduce vulnerable or breaking versions through supply-chain drift, even if no specific exploit is present in the manifest itself.
- Content
text requests>=2.28.0 websockets>=12.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The manifest references requests without an exact version while the package has multiple known advisories across its release history. Because the installed version is not fixed, it is impossible to verify from this file alone whether deployments will receive a safe version, creating avoidable supply-chain uncertainty.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The websockets package is unpinned, so installations may resolve to different versions over time depending on when and where the skill is deployed. That weakens reproducibility and can expose the project to newly introduced vulnerable or incompatible releases without any code change in the repository.
- Content
text requests>=2.28.0 websockets>=12.0
Unverifiable Dependency: websockets has 4 known advisory(ies) (CVE-2018-1000518 (websockets is vulnerable to denial of service by memory exhaustion); CVE-2021-33880 (Observable Timing Discrepancy in aaugustin websockets library); CVE-2018-1000518 (aaugustin websockets version 4 contains a CWE-409: Improper Handling of Highly C) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The websockets dependency has known historical advisories, but this manifest does not constrain the installed version to a reviewed safe release. That means consumers of the skill could install an affected version unknowingly, especially in fresh or automated environments.
- Content