T08 · Insecure Dependencies
Warning
- Location
SKILL.md:11- Finding
Downloaded Native Runtime Is Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
sherpa-onnx-tts
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent offline text-to-speech wrapper, but it downloads and runs an unverified native runtime with the user's normal process environment.
Install only if you trust the k2-fsa/sherpa-onnx release artifacts and are comfortable running a downloaded native binary under your user account. Prefer verifying release hashes or signatures yourself, and avoid running it from an agent process that has sensitive credentials in environment variables.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest and usage documentation default to the
en_USLessac voice model and present it as the installed model, which imposes a specific locale choice in the skill's natural-language-facing setup. The file does not offer a user opt-in or selection flow for language/locale, beyond a later generic note that another voice model can be picked.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
text Then write those resolved paths into the active OpenClaw config file (`$OPENCLAW_CONFIG_PATH`, default `~/.openclaw/openclaw.json`): ```json5 {
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest describes a local offline text-to-speech skill, which would justify local model/file access and audio output generation. However, this implementation launches an arbitrary executable from a user-/env-controlled runtime directory and passes through the entire environment, which is a process-execution capability not implied by the stated purpose.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file documents installation steps that download runtime/model archives from GitHub, extract them into local directories, and instruct the user to write paths into the active OpenClaw config file. While the steps are described functionally, there is no explicit user warning about these filesystem changes or the fact that external artifacts are fetched and stored locally.
- Content