🗣️ Edge-TTS Skill using uvx

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:19 PM UTC
• Version: 1.0.0

Overview

The skill has a clear text-to-speech purpose, but its command templates could expose users to unsafe shell execution and mutable third-party code.

Review before installing. Use this only with non-sensitive text, prefer a pinned and reviewed edge-tts version, and ensure any agent runs it with a safe process API using separate arguments rather than constructing a shell string from user text or filenames.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Runtime Execution of an Unpinned Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-21; similar invocations occur at lines 26-27, 32, 37, and 83
Vulnerability Type: Unpinned runtime dependency execution
Risk Level: Medium

Vulnerable Code

shell

uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3

# With subtitles
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --write-subtitles -

Additional instances execute the same dependency without a version constraint:

shell

uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --rate=+50%
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --volume=+50% --pitch=-50Hz
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --voice=zh-CN-XiaoxiaoNeural
uvx edge-tts --list-voices

Technical Analysis

The skill instructs the agent to resolve and execute edge-tts through uvx without specifying an exact package version, package hash, lockfile, trusted package index, or verified publisher. Runtime package resolution means the code executed during a future invocation may differ from the code that existed when the skill was reviewed.

The documentation also describes the dependency as the node-edge-tts npm package, while the actual command uses uvx edge-tts. This provenance mismatch makes it less clear which package implementation and registry source are intended.

Although the repository itself contains no embedded executable scripts, invoking an unpinned package introduces a supply-chain trust boundary outside the reviewed project.

Attack Path

1. An attacker compromises the package distribution account, publishes a malicious version under the resolved package name, or influences resolution toward an unsafe source.
2. A user or agent invokes one of the documented uvx edge-tts commands.
3. uvx resolves and downloads the dependency available at invocation time.
4. The downloaded p ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an audited, exact version rather than invoking an unconstrained package name.
• Use a lockfile and package integrity hashes where supported.
• Configure and document an explicitly trusted package index and publisher.
• Verify the package before execution and cache an approved artifact instead of resolving mutable code during each invocation.
• Correct the discrepancy between the stated npm package and the package executed through uvx.
• Run the TTS utility in a sandbox with minimal filesystem access, restricted environment variables, and only the network access required for TTS generation.
• Establish an update process that reviews package changes before advancing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:20

Finding

Shell Command Injection Through Unsafe Placeholder Interpolation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-21; the same unsafe construction is repeated at lines 26-27, 32, and 37
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

shell

uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3

# With subtitles
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --write-subtitles -

Related command templates:

shell

uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --rate=+50%
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --volume=+50% --pitch=-50Hz
uvx edge-tts --text "{msg}" --write-media {tempdir}/{filename}.mp3 --voice=zh-CN-XiaoxiaoNeural

Technical Analysis

These templates encourage direct substitution of message and path values into a shell command. The {msg} placeholder is enclosed in double quotes, but double quotes do not suppress shell command substitution using $(...) or backticks. The {tempdir} and {filename} placeholders are not quoted at all, allowing shell metacharacters, whitespace, substitutions, redirections, and additional command separators to affect parsing.

If an agent constructs a command string from these templates and executes it through a shell, attacker-controlled text or filename data can escape the intended argument context. This is distinct from safely launching the executable with an argument array, where the operating system passes each value as data without shell interpretation.

Attack Path

1. An attacker submits a TTS request containing shell substitution syntax in the message, such as a value incorporating $(attacker_command), or supplies a filename containing shell metacharacters.
2. The agent replaces {msg}, {tempdir}, or {filename} in the documented command template with the attacker-controlled value.
3. The agent executes the resulting string through a shell.
4. The shell evalua ...[truncated 921 chars]

Remediation

View remediation

Remediation Suggestions

• Do not build shell command strings by interpolating user-controlled values.
• Launch uvx through a process API that accepts an argument array and disables shell execution. Pass edge-tts, --text, the complete message, --write-media, and the output path as separate arguments.
• Treat messages, filenames, temporary directories, voice names, and adjustment values as untrusted data.
• Generate output filenames internally rather than accepting arbitrary path fragments from users.
• Restrict output to an approved temporary directory, resolve the canonical path, and verify that it remains within that directory.
• Reject path traversal, control characters, absolute paths, and unsupported filename characters.
• Validate voice, rate, volume, pitch, and format values against strict allowlists or bounded parsers.
• Use secure temporary-file APIs with restrictive permissions and collision-resistant names.
• If shell execution is unavoidable, apply platform-specific escaping to every dynamic argument; argument-array execution should still be preferred.
• Run the command with least privilege and restrict access to sensitive files, credentials, and unnecessary network destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs use of 'uvx edge-tts' without pinning a specific package version. Because uvx resolves and runs packages dynamically, an upstream malicious update or unexpected version change could alter behavior and execute unreviewed code in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill describes TTS generation via Microsoft's Edge neural service but does not clearly warn that provided text is transmitted to an external Microsoft-operated service for synthesis. This can lead users or agents to send sensitive, proprietary, or regulated content off-box without informed consent, creating privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command runs 'uvx edge-tts' directly with no version pinning. That creates a supply-chain risk: future package changes, compromise of the package, or dependency drift could cause execution of different code than the skill author intended.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The subtitle example again invokes 'uvx edge-tts' without constraining the package version. In an agent setting, this increases supply-chain exposure because the runtime may fetch and execute the latest available code rather than a reviewed build.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This rate-adjustment example still depends on an unpinned 'uvx edge-tts' package resolution. The danger is not the '--rate' flag, but the dynamic execution of whatever version uvx resolves at run time.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This volume/pitch example repeats the same unpinned dynamic package execution pattern. If the package or one of its dependencies is compromised, every invocation path shown in the skill becomes a vehicle for arbitrary code execution or unexpected data handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The voice-selection example invokes 'uvx edge-tts' without version pinning, preserving the same supply-chain risk. Skill context makes this somewhat more concerning because it is intended for repeated automated execution by agents, not just manual one-off usage.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The 'list voices' command also uses unpinned 'uvx edge-tts'. Even though it appears lower-risk functionally, it still requires executing remotely resolved package code and therefore carries the same core supply-chain risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.