Sherpa Onnx Tts Andy27725

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:16 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward offline text-to-speech helper, with a supply-chain caution because it downloads native runtime archives without pinned integrity checks.

Install only if you are comfortable trusting the upstream sherpa-onnx GitHub release assets. Because native binaries are downloaded and extracted without declared checksum verification, a cautious user should verify release provenance or run the tool in a constrained environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Downloaded Native Runtime Is Not Cryptographically Verified

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-50
Vulnerability Type: Unverified third-party executable dependency
Risk Level: Medium

The Skill downloads and automatically extracts platform-specific native sherpa-onnx runtime archives and a voice model from GitHub releases. Although the runtime version is pinned and the downloads use HTTPS, the configuration does not specify or verify cryptographic checksums or signatures.

json

"install":
  [
    {
      "id": "download-runtime-macos",
      "kind": "download",
      "os": ["darwin"],
      "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-osx-universal2-shared.tar.bz2",
      "archive": "tar.bz2",
      "extract": true,
      "stripComponents": 1,
      "targetDir": "runtime",
      "label": "Download sherpa-onnx runtime (macOS)",
    },
    {
      "id": "download-runtime-linux-x64",
      "kind": "download",
      "os": ["linux"],
      "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-linux-x64-shared.tar.bz2",
      "archive": "tar.bz2",
      "extract": true,
      "stripComponents": 1,
      "targetDir": "runtime",
      "label": "Download sherpa-onnx runtime (Linux x64)",
    },
    {
      "id": "download-runtime-win-x64",
      "kind": "download",
      "os": ["win32"],
      "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-win-x64-shared.tar.bz2",
      "archive": "tar.bz2",
      "extract": true,
      "stripComponents": 1,
      "targetDir": "runtime",
      "label": "Download sherpa-onnx runtime (Windows x64)",
    },
    {
      "id": "download-model-lessac",
      "kind": "download",
      "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/tts-models/vits-piper-en_US-lessac-high.tar.bz2",
      "archive": "tar.bz2",
      "extract":
...[truncated 2444 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish and pin a trusted SHA-256 or stronger digest for every supported runtime archive and the model archive.
2. Verify the complete downloaded archive before extraction and fail installation on any mismatch.
3. Prefer upstream cryptographic signatures in addition to hashes, and verify them against a pinned, independently distributed maintainer public key.
4. Ensure verification metadata is reviewed whenever the sherpa-onnx version or model is updated.
5. Extract archives only after verification and reject absolute paths, parent-directory traversal entries, links escaping the destination, and unexpected executable files.
6. Run the runtime with ordinary user privileges and restrict filesystem and network access where the host platform supports sandboxing.
7. Document the exact upstream release provenance and a reproducible update procedure so reviewers can validate future dependency changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep