ClawHub
Back to skill

Security audit

Tts

Security checks across malware telemetry and agentic risk

Overview

This text-to-speech skill appears to do what it says: send requested text to Hume or OpenAI to generate audio, without evidence of hidden access or persistence.

Install this only if you are comfortable sending the text you provide to Hume AI or OpenAI for speech generation. Do not use it for secrets, regulated data, or private content unless those providers are approved for your use case; review dependency updates if installing from the package manifest instead of a locked install.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends user-provided text to Hume's external TTS API, which creates a data exposure risk if the text contains sensitive or regulated information. The only notice is a generic log message, and it does not provide explicit user consent, redaction, or policy enforcement before transmitting content off-box.

External Transmission

Medium
Category
Data Exfiltration
Content
try {
    console.log(`Generating speech via Hume AI for: "${options.text.substring(0, 50)}..."`);
    
    const response = await fetch('https://api.hume.ai/v0/tts', {
      method: 'POST',
      headers: {
        'X-Hume-Api-Key': apiKey,
Confidence
84% confidence
Finding
fetch('https://api.hume.ai/v0/tts', { method: 'POST'

External Transmission

Medium
Category
Data Exfiltration
Content
try {
    console.log(`Generating speech via Hume AI for: "${options.text.substring(0, 50)}..."`);
    
    const response = await fetch('https://api.hume.ai/v0/tts', {
      method: 'POST',
      headers: {
        'X-Hume-Api-Key': apiKey,
Confidence
84% confidence
Finding
https://api.hume.ai/

Unpinned Dependencies

Low
Category
Supply Chain
Content
"description": "Helper script for OpenAI TTS",
  "main": "generate_speech.js",
  "dependencies": {
    "openai": "^4.0.0",
    "commander": "^11.0.0"
  }
}
Confidence
93% confidence
Finding
"openai": "^4.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"main": "generate_speech.js",
  "dependencies": {
    "openai": "^4.0.0",
    "commander": "^11.0.0"
  }
}
Confidence
93% confidence
Finding
"commander": "^11.0.0"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/generate_hume_speech.js:14