Security audit

AdsTurbo 虚拟人口播 · AdsTurbo Digital Human Voiceover

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AdsTurbo digital-human integration, but it enables face and voice cloning workflows without enough consent, privacy, or destructive-action guardrails.

Install only if you are comfortable sending media and scripts to AdsTurbo and potentially receiving public asset URLs. Use it only with faces, voices, and recordings you own or are authorized to use, avoid impersonation or deceptive synthetic media, and treat persona deletion as final unless AdsTurbo documents recovery.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match generic requests like voiceover, dubbing, or having someone say text, which can cause the skill to activate outside its intended boundaries. In this skill’s context, unintended activation is more concerning because it can lead to external API usage, user media uploads, and potentially billable actions being selected when a different skill would have been more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Chinese trigger phrases are similarly broad and can match ordinary media-editing or audio requests that are outside the skill’s stated scope. Because this skill can drive external processing of user-provided photos and audio, accidental routing increases the risk of privacy-impacting or billable operations being proposed or initiated incorrectly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation encourages users to upload portrait photos and optional voice samples for avatar creation and voice cloning, but it provides no guidance about obtaining consent, verifying rights to the media, or handling biometric/voice data safely. In this context, the omission increases the risk of non-consensual cloning, privacy violations, and misuse of sensitive personal likeness and voice data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The lip-sync workflow explicitly allows pairing any portrait with any audio and presents this as a simple one-off operation, but it omits warnings about consent, impersonation, deceptive media, or abuse. In a digital-human tool, that omission is especially dangerous because it directly enables realistic non-consensual deepfake content using another person's face and voice-like audio.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Requiring photo and audio assets to be provided as public URLs can expose highly sensitive personal media to anyone who can access those links, yet the documentation does not warn users about that exposure. Because the referenced assets include portraits and voice recordings, this can lead to unintended public disclosure, scraping, or later reuse outside the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document repeatedly instructs users to convert local files into publicly accessible URLs and emphasizes doing so 'every time,' but it never warns that this exposes user-provided local assets to a third-party remote service and potentially to public access. In a skill that handles photos, audio, and video—especially voice-cloning samples and personal portraits—this omission can lead to unintentional disclosure of sensitive or biometric data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Mentioning bearer-token authentication may reassure users about request security, but the documentation still omits that the file contents themselves are being sent off-host to an external service and then exposed as a URL for downstream use. That combination creates a meaningful risk of users misunderstanding the trust boundary and uploading sensitive local media under the false assumption that authentication alone implies confidentiality.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The persona creation flow sends a user-supplied portrait URL and optional voice sample URL to a remote service to build a synthetic identity, but the CLI provides no explicit warning, consent checkpoint, or validation around highly sensitive biometric data. In this skill’s context, that omission is more dangerous than usual because the feature is specifically designed for face/voice cloning, which raises privacy, consent, and misuse risks even if the underlying API call is intentional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The persona-delete command performs an irreversible remote deletion based solely on an actor ID, with no confirmation prompt, dry-run mode, or warning. This is primarily an unsafe UX/security control gap rather than malicious behavior, but it can lead to accidental destruction of remote assets or operational disruption if invoked incorrectly or by a confused user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The lipsync command transmits a portrait and audio track to an external service without any explicit disclosure that user media is being sent off-system for processing. In this skill’s context, the risk is elevated because the media can contain personal likeness and voice data used to generate synthetic content, creating privacy, consent, and impersonation concerns if users are not clearly warned.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The command handlers upload a user-specified local file to remote storage endpoints, which is a network operation transmitting local data. This file contains no confirmation prompt, warning print/log message, or explicit disclosure to the user about the privacy impact of making local content available via a public URL.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description presents both English and Chinese content but does not state whether the skill adapts to the user's preferred language or locale. This can create ambiguity around default language behavior and may conflict with a policy requiring language choice or explicit opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The examples for text-to-speech and narration use Chinese script content, and the document is duplicated bilingually without stating whether the skill supports multiple languages or whether Chinese is required. Because no user opt-in or explicit locale limitation is documented, this may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 24% confidence
Finding: I did not identify a natural-language policy violation here. The file includes both English and Chinese versions of the same instructions, which offers language coverage rather than imposing a mandatory locale. Because SQP-3 only applies to actual language/locale policy violations, this should not be treated as a finding.
Content: No source excerpt is available for this finding.