Security audit

AdsTurbo 虚拟人口播 · AdsTurbo Digital Human Voiceover

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for AdsTurbo digital-human generation, but it needs Review because it can upload face and voice media for avatar or voice cloning without strong consent, privacy, or retention safeguards.

Install only if you are comfortable sending selected photos, voice recordings, audio, and video assets to AdsTurbo and potentially receiving public asset URLs. Use only media you own or have explicit permission to use, especially for voice cloning or likeness generation, and review AdsTurbo's retention and deletion controls before using real people or sensitive content.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill description encourages uploading highly sensitive biometric-like data—personal photos and voice samples—to an external service without warning about privacy, retention, consent, or third-party processing. This is dangerous because users may unknowingly submit personal or third-party identity data, creating privacy, consent, and impersonation risks.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The instructions tell the agent to upload local portrait and voice files but omit any warning to obtain consent, verify ownership, or disclose that the files will be transferred to an external service. In this context, the omission is more dangerous because the workflow specifically handles identity-bearing media that can be used for voice cloning and avatar creation.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The Chinese upload instructions mirror the same omission: they operationalize external upload of personal portrait and voice data without any privacy, consent, or data-handling warning. Because the skill supports cloning a person’s likeness and voice, lack of notice materially increases the risk of non-consensual impersonation and privacy violations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly enables creation of custom avatars from a user's photo and optional voice cloning from uploaded audio, but it does not warn about consent, impersonation, biometric privacy, or rights to use another person's likeness and voice. In this context, omission of these warnings is dangerous because users may upload third-party media or sensitive personal media without understanding the privacy and misuse risks inherent in avatar generation and voice cloning.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation states that portrait, avatar, and audio assets must be converted into public URLs, but it does not warn that doing so can expose highly sensitive biometric and personal media to unintended parties. This is especially risky here because the assets include face photos and voice recordings, which are uniquely identifying and can be reused for surveillance, impersonation, or unauthorized redistribution once publicly accessible.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guidance repeatedly instructs users to upload local assets so they become publicly accessible URLs, but it does not explicitly warn that this may expose private photos, audio, or video to the public internet. In a skill that handles user-provided media, this omission can lead to accidental disclosure of sensitive content because users may assume upload is only an internal processing step.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This script uploads arbitrary local files to remote endpoints and the module description explicitly says it turns a local file into a public URL. There is no confirmation prompt, warning, or disclosure in this file that local file contents will be transmitted and exposed externally, which increases the risk of accidental data exfiltration if invoked on sensitive paths.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only (`requests>=2.28.0`), which makes builds non-reproducible and can unexpectedly resolve to insecure or incompatible versions depending on when and where installation occurs. In security-sensitive automation, unpinned dependencies increase supply-chain risk and make it harder to audit exactly what code is executed.

Known Vulnerable Dependency: requests==2.28.0 — 8 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +5 more

High

Category: Supply Chain
Confidence: 71% confidence
Finding: The requirement allows installation of `requests` version 2.28.0, and the static analysis indicates that version has multiple published advisories. Because the specifier is `>=2.28.0`, some environments may install a safe newer version, but others can still end up with the vulnerable minimum or other unreviewed versions, so the dependency declaration does not prevent exposure.

Static analysis

No suspicious patterns detected.