sag

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 9:33 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward ElevenLabs text-to-speech helper, with expected privacy and supply-chain cautions but no hidden or purpose-mismatched behavior found.

Install this only if you are comfortable using the sag CLI from the listed Homebrew tap and sending text you ask to vocalize to ElevenLabs under your API key. Avoid using voice replies for secrets or sensitive personal data, and clean up generated /tmp audio files if that matters on your system.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Homebrew Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–18
Vulnerability Type: Supply-chain risk from an unpinned third-party package source
Risk Level: Medium

Vulnerable Code Snippet

yaml

"install":
  [
    {
      "id": "brew",
      "kind": "brew",
      "formula": "steipete/tap/sag",
      "bins": ["sag"],
      "label": "Install sag (brew)",
    },
  ],

Technical Analysis

The skill directs users to install sag from the third-party Homebrew tap steipete/tap without specifying a fixed version, immutable artifact digest, or checksum. The dependency's implementation is not included in the reviewed project, so its installation logic and executable behavior cannot be audited from this package.

Because the formula is mutable, a compromise of the tap, its maintainer account, release infrastructure, or referenced artifacts could cause future installations to retrieve attacker-controlled code without any change to this skill. This is a supply-chain exposure rather than evidence that the current dependency is malicious.

Attack Path

1. An attacker compromises the third-party Homebrew tap, maintainer credentials, release infrastructure, or an artifact referenced by the formula.
2. The attacker modifies the formula or release artifact to include malicious installation or runtime behavior.
3. A user installs the skill dependency through the declared steipete/tap/sag formula.
4. Homebrew downloads and executes or installs the attacker-controlled content under the installing user's privileges.
5. The malicious sag executable can subsequently run whenever the skill invokes it.
6. If ELEVENLABS_API_KEY or SAG_API_KEY is present in the executable's environment, the malicious program may read and exfiltrate it.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user installing or invoking the dependency. Th ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer a verified official package source whose ownership and release process can be independently validated.
2. Pin the dependency to a specific audited version rather than implicitly accepting the latest formula revision.
3. Verify downloaded artifacts with a cryptographic SHA-256 checksum or a trusted signature before installation.
4. Record the expected formula revision, source repository, release artifact, and checksum in the skill metadata or installation documentation.
5. Use automated dependency monitoring to detect formula ownership changes, checksum changes, compromised releases, and newly disclosed vulnerabilities.
6. Run the TTS executable with least privilege and expose only the environment variables and filesystem paths required for operation.
7. Store the ElevenLabs API key in an appropriate secret manager, restrict its account permissions and quota where supported, and rotate it if dependency compromise is suspected.
8. Consider vendoring or reproducibly building a reviewed version of the dependency when the platform supports secure, immutable distribution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly instructs the agent to create an audio file in /tmp and then send it as media, which causes user content to be written to local storage and transmitted to an external service and back to the user without any notice or consent step. In this skill’s context, that behavior is central to functionality, but it still creates privacy and data-handling risk because spoken replies may contain sensitive user data and /tmp is a shared, ephemeral filesystem location on many systems.

Content

No source excerpt is available for this finding.