Security audit

article-tts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OCR-to-speech helper, but users should understand that it can send generated audio through chat channels and relies on an unpinned TTS package downloaded at runtime.

Before installing, be comfortable with OCR text and generated audio being sent back through the active chat channel, keep confirmation enabled for sensitive images, and prefer a pinned or preinstalled edge-tts plus private per-run temp files if you operate this in a shared environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:108
Finding: Unpinned Third-Party Package Is Downloaded and Executed at Runtime
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:85
Finding: Predictable Shared Temporary File Used for OCR Input
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The skill depends on uvx/edge-tts without pinning a specific package version, so execution may pull whatever current upstream release is available at runtime. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code or alter behavior in an automation context.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skip-confirmation flow allows OCR-extracted text to be converted to audio and sent without user review, which increases the risk of transmitting sensitive or misrecognized content. Because OCR commonly captures nearby private data and can make errors, removing the verification step materially weakens privacy and accuracy safeguards.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: Invoking uvx edge-tts directly without a pinned version means the skill may run unreviewed upstream code each time it is used. In agent environments, this expands the trust boundary to the package registry and increases the chance of supply-chain compromise or unexpected behavior changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This second uvx edge-tts usage has the same issue: it relies on an unpinned remote package resolution path during execution. Attackers who compromise the package supply chain or a dependency could gain code execution in the environment running the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill automatically sends generated audio through the active messaging channel, but the top-level description does not prominently warn that OCR-derived text may be transmitted off-host. In practice, users may treat this as a local OCR/TTS utility and unintentionally exfiltrate sensitive article contents or personal information through chat integrations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes this skill as converting article photos or text into audio using OCR and Edge TTS. However, this section instructs the agent to call another skill's Python scripts under /skills/feishu-voice-send/ to send voice messages via Feishu, which extends the skill into channel-specific message delivery orchestration beyond the core article-to-audio function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This section adds a channel-specific media transcoding and delivery workflow: converting MP3 to Ogg Opus with ffmpeg and then sending through a messaging tool. That capability is not mentioned in the manifest description, which is limited to OCR/text input and Edge TTS generation with configurable language, speed, voice, and sentence splitting.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The documented command again runs edge-tts through uvx without version pinning, preserving the same supply-chain exposure. Because this skill may process user-provided content and access messaging integrations, compromise of the fetched tool could have downstream privacy and integrity impact.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The voice-listing command also relies on unpinned uvx edge-tts, so even non-core helper commands can trigger execution of unvetted upstream code. Repeated unpinned examples normalize insecure dependency handling for operators.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.