rupali

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:28 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent voice-reply helper that uses a disclosed TTS provider and local MP3 output, with privacy considerations but no artifact-backed malicious behavior.

Install only if you are comfortable with generated reply text being sent to Sarvam's TTS API using your SARVAM_API_KEY and with MP3 files being returned in the requesting chat channel. Avoid using it for highly private or sensitive conversations unless that third-party processing is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'headers' from os.getenv (line 25, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

output_path.parent.mkdir(parents=True, exist_ok=True)

    with requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=60) as r:
        r.raise_for_status()
        with open(output_path, "wb") as f:
            for chunk in r.iter_content(chunk_size=8192):

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared behavior says the skill generates a persona-driven reply and sends audio across multiple chat channels, but the documented implementation only demonstrates generic local TTS file creation. This mismatch is dangerous because operators and users may authorize or invoke the skill under false assumptions about what it does, which weakens trust, review quality, and consent for downstream actions like external messaging.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill invokes a local script, depends on an environment API key, and implies outbound TTS/network use, but it declares no explicit tool scope or permissions. That makes its runtime capabilities under-specified, which can lead to overbroad access, unsafe deployment assumptions, and use of sensitive credentials or network egress without clear review boundaries.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger description is broad enough to match common casual conversation, increasing the chance the skill activates in contexts where the user did not intend TTS generation or persona-style responses. In a multi-skill environment, this can cause unintended processing, unexpected external data transmission to a TTS provider, or unsolicited file responses.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The workflow states that MP3 audio will be sent back through external chat channels, but the skill lacks a clear user-facing warning or consent model for this outbound delivery. That creates privacy and expectation risks because generated content may be transmitted or stored by third-party platforms without the user understanding that the skill will do so.

External Transmission

Medium

• Category: Data Exfiltration

Content

from pathlib import Path
import requests

API_URL = "https://api.sarvam.ai/text-to-speech/stream"


def stream_tts(

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

output_path.parent.mkdir(parents=True, exist_ok=True)

    with requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=60) as r:
        r.raise_for_status()
        with open(output_path, "wb") as f:
            for chunk in r.iter_content(chunk_size=8192):

• Confidence: 83% confidence
• Finding: The script sends user text to a third-party network service for processing, which creates an external data-sharing boundary. Given the skill's flirtatious companion context, messages may contain personal, romantic, or otherwise sensitive content, increasing the privacy impact if users are not clearly informed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: User-provided text is transmitted to an external third-party TTS API with no in-code notice, consent check, or privacy guardrails. In a chat companion skill, users may submit intimate or sensitive content, making undisclosed external transmission a meaningful privacy risk.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The workflow requires replies to be written 'in Indian-English tone' as a default instruction, but there is no indication that the user can choose or opt into that locale. This creates a language/locale policy issue because the skill imposes a specific regional style regardless of user preference.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: Mentioning an environment API key and external TTS dependency without credential-handling or transmission warnings obscures the fact that user text is likely sent to a third-party service under account credentials. While not direct secret exposure in the document, poor disclosure and handling guidance increase the risk of accidental credential misuse and unreviewed external data sharing.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The function defaults target_language_code to en-IN, imposing a specific locale unless the caller overrides it. While a --lang option exists, the default still forces a locale choice without documenting a user opt-in or justification.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The script creates parent directories and writes binary output to the specified path, which modifies the local filesystem. Although file output is part of the tool's purpose, there is no visible notice about the write behavior or potential overwrite risk for an existing file.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The command-line interface defaults --lang to en-IN, which hardcodes a locale selection in user-facing behavior. This can conflict with policy requiring language or locale choice unless the restriction is justified or explicitly accepted by the user.

Static analysis

No suspicious patterns detected.