Security audit

🗣️ Text-to-speech using GLM-TTS for generating audio

Security checks for vulnerabilities and agentic risk

Overview

This TTS skill is disclosed and purpose-aligned, but it asks users to extract a browser session token and gives it to an unpinned runtime package.

Review before installing. Only use this if you are comfortable giving a browser-derived Z.ai session token to a command-line package and sending selected text or files to the external TTS service. Prefer a version-pinned client and a proper scoped API credential if available, and avoid processing sensitive documents or private prompts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:48
Finding: Unpinned Third-Party Package Is Dynamically Downloaded and Executed
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:21
Finding: Browser Session Token Is Exposed to a Dynamically Executed Process
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:48
Finding: User-Controlled Values Are Interpolated into Shell Command Templates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ssd 3

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill explicitly instructs users to extract an auth token from browser localStorage and supply it to the skill as an environment variable. This is highly dangerous because localStorage tokens are often session credentials; copying them into another tool broadens their exposure, bypasses intended browser security boundaries, and can enable account takeover or unauthorized API use if leaked.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The install instructions tell users to retrieve a user identifier directly from browser localStorage via developer tools. Normalizing manual extraction of authentication-related browser state encourages unsafe credential handling practices and increases the chance of accidental disclosure, misuse, or phishing-style imitation by other skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage section shows how to send arbitrary text or files to the GLM-TTS service but does not prominently warn that content is transmitted to an external third party. This is dangerous because users may unknowingly send sensitive prompts, documents, or personal data off-platform, creating privacy, confidentiality, and compliance risks.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation repeats the instruction to obtain required environment variables by reading browser localStorage contents. This institutionalizes insecure secret handling and conditions users to move browser-resident auth material into shell environments, where it may be logged, inherited by subprocesses, or accidentally exposed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill repeatedly instructs use of uvx zai-tts without pinning a specific package version or artifact. This creates a supply-chain risk because future upstream releases could change behavior or become compromised, and the agent would fetch and execute whatever version is current at runtime.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation guidance is broad enough to trigger on many normal situations like accessibility, multitasking, podcast, driving, or cooking, rather than a narrow explicit user request. In an agent setting, that can cause unintended external transmission of user content and accidental use of stored credentials when the user did not clearly consent to TTS processing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The command example invokes uvx zai-tts without a fixed version, so execution depends on the latest available upstream package at run time. In an agent skill, that increases supply-chain exposure because command behavior can drift or be hijacked without any change to the skill itself.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This example uses uvx zai-tts without constraining the resolved package version. That means the skill may execute newly published code from the package source, making compromise or accidental breaking changes materially possible.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: An unpinned uvx zai-tts invocation exposes users to remote package updates outside the skill author's control. In practice, this is a supply-chain weakness because the exact code executed tomorrow may not be the same code reviewed today.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill shows another runtime fetch-and-execute pattern via unversioned uvx zai-tts. Because the command is intended for agent use, unpinned execution can directly import unreviewed code into the workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command example repeats the same unpinned package execution pattern, leaving the skill dependent on whatever code the remote registry serves at invocation time. That is a real and common supply-chain hazard rather than a purely stylistic issue.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The voice-selection example still uses an unpinned uvx zai-tts command, so the same supply-chain risk applies regardless of flags. The danger is amplified in agent contexts because users may assume skill commands are stable and pre-reviewed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Listing voices via uvx zai-tts -l still executes an unpinned remote package. Even seemingly harmless read-only operations can run arbitrary code during package resolution or startup if the upstream package is compromised.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.