ClawHub
Back to skill

Security audit

rupali

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent voice-reply helper that uses a disclosed TTS provider and local MP3 output, with privacy considerations but no artifact-backed malicious behavior.

Install only if you are comfortable with generated reply text being sent to Sarvam's TTS API using your SARVAM_API_KEY and with MP3 files being returned in the requesting chat channel. Avoid using it for highly private or sensitive conversations unless that third-party processing is acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tainted flow: 'headers' from os.getenv (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/bulbul_tts.py (reported line 44)May include surrounding context.

python
output_path.parent.mkdir(parents=True, exist_ok=True)

    with requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=60) as r:
        r.raise_for_status()
        with open(output_path, "wb") as f:
            for chunk in r.iter_content(chunk_size=8192):

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared behavior says the skill generates a persona-driven reply and sends audio across multiple chat channels, but the documented implementation only demonstrates generic local TTS file creation. This mismatch is dangerous because operators and users may authorize or invoke the skill under false assumptions about what it does, which weakens trust, review quality, and consent for downstream actions like external messaging.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill invokes a local script, depends on an environment API key, and implies outbound TTS/network use, but it declares no explicit tool scope or permissions. That makes its runtime capabilities under-specified, which can lead to overbroad access, unsafe deployment assumptions, and use of sensitive credentials or network egress without clear review boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger description is broad enough to match common casual conversation, increasing the chance the skill activates in contexts where the user did not intend TTS generation or persona-style responses. In a multi-skill environment, this can cause unintended processing, unexpected external data transmission to a TTS provider, or unsolicited file responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The workflow states that MP3 audio will be sent back through external chat channels, but the skill lacks a clear user-facing warning or consent model for this outbound delivery. That creates privacy and expectation risks because generated content may be transmitted or stored by third-party platforms without the user understanding that the skill will do so.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bulbul_tts.py (reported line 7)May include surrounding context.

python
from pathlib import Path
import requests

API_URL = "https://api.sarvam.ai/text-to-speech/stream"


def stream_tts(

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The script sends user text to a third-party network service for processing, which creates an external data-sharing boundary. Given the skill's flirtatious companion context, messages may contain personal, romantic, or otherwise sensitive content, increasing the privacy impact if users are not clearly informed.

Content

Scanner excerpt · scripts/bulbul_tts.py (reported line 44)May include surrounding context.

python
output_path.parent.mkdir(parents=True, exist_ok=True)

    with requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=60) as r:
        r.raise_for_status()
        with open(output_path, "wb") as f:
            for chunk in r.iter_content(chunk_size=8192):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

User-provided text is transmitted to an external third-party TTS API with no in-code notice, consent check, or privacy guardrails. In a chat companion skill, users may submit intimate or sensitive content, making undisclosed external transmission a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow requires replies to be written 'in Indian-English tone' as a default instruction, but there is no indication that the user can choose or opt into that locale. This creates a language/locale policy issue because the skill imposes a specific regional style regardless of user preference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Mentioning an environment API key and external TTS dependency without credential-handling or transmission warnings obscures the fact that user text is likely sent to a third-party service under account credentials. While not direct secret exposure in the document, poor disclosure and handling guidance increase the risk of accidental credential misuse and unreviewed external data sharing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The function defaults target_language_code to en-IN, imposing a specific locale unless the caller overrides it. While a --lang option exists, the default still forces a locale choice without documenting a user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script creates parent directories and writes binary output to the specified path, which modifies the local filesystem. Although file output is part of the tool's purpose, there is no visible notice about the write behavior or potential overwrite risk for an existing file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The command-line interface defaults --lang to en-IN, which hardcodes a locale selection in user-facing behavior. This can conflict with policy requiring language or locale choice unless the restriction is justified or explicitly accepted by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.