ClawHub
Back to skill

Security audit

sherpa-onnx-tts

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent offline text-to-speech wrapper, but it downloads and runs an unverified native runtime with the user's normal process environment.

Install only if you trust the k2-fsa/sherpa-onnx release artifacts and are comfortable running a downloaded native binary under your user account. Prefer verifying release hashes or signatures yourself, and avoid running it from an agent process that has sensitive credentials in environment variables.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:11
Finding
Downloaded Native Runtime Is Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-48`; `bin/sherpa-onnx-tts:143-176` **Vulnerability Type**: Unverified third-party executable dependency **Risk Level**: Medium ### Vulnerable Code The installation metadata downloads and extracts platform-specific native runtime archives and a model archive from GitHub Releases without declaring or verifying cryptographic hashes or signatures: ```json5 "install": [ { "id": "download-runtime-macos", "kind": "download", "os": ["darwin"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.2/sherpa-onnx-v1.13.2-osx-universal2-shared.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (macOS)", }, { "id": "download-runtime-linux-x64", "kind": "download", "os": ["linux"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.2/sherpa-onnx-v1.13.2-linux-x64-shared.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (Linux x64)", }, { "id": "download-runtime-win-x64", "kind": "download", "os": ["win32"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.2/sherpa-onnx-v1.13.2-win-x64-shared-MD-Release.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (Windows x64)", }, { "id": "download-model-lessac", "kind": "download", "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/tts-models/vits-piper-en_US-lessac-high.tar.bz2", "archive": "tar.bz2", "extract": true, "targetDir": "models", "label": "Download Piper en_US lessac (high)", }, ], ``` The wrapper subseq ...[truncated 4477 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Publish and pin a SHA-256 or stronger digest for every supported runtime archive and for the model archive. 2. Verify the digest before extraction and fail closed if verification fails. Do not execute or retain an artifact whose digest does not match. 3. Prefer cryptographically signed release manifests. Verify signatures against a maintainer public key whose fingerprint is pinned through a separate trusted channel. 4. Keep runtime versions immutable and update the pinned URL, digest, and signature information together through reviewed changes. 5. Extract archives into a fresh, dedicated directory and reject unsafe archive entries, including absolute paths, `..` traversal, and links escaping the destination. 6. Minimize the environment supplied to the native child process. Construct an allowlist containing only variables required by the runtime rather than copying all of `process.env`. 7. Run the native runtime under a restricted, non-administrative account or sandbox where supported, limiting filesystem and network access to the model directory and requested output location. 8. Apply equivalent integrity controls to voice models because malformed model data may exercise native parser vulnerabilities. 9. Document the exact upstream project, release version, expected hashes, and verification procedure so users can independently validate installed artifacts. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The manifest and usage documentation default to the `en_US` Lessac voice model and present it as the installed model, which imposes a specific locale choice in the skill's natural-language-facing setup. The file does not offer a user opt-in or selection flow for language/locale, beyond a later generic note that another voice model can be picked.

Session Persistence

Medium
Category
Rogue Agent
Content
STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}"
```

Then write those resolved paths into the active OpenClaw config file (`$OPENCLAW_CONFIG_PATH`, default `~/.openclaw/openclaw.json`):

```json5
{
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The manifest describes a local offline text-to-speech skill, which would justify local model/file access and audio output generation. However, this implementation launches an arbitrary executable from a user-/env-controlled runtime directory and passes through the entire environment, which is a process-execution capability not implied by the stated purpose.

Missing User Warnings

Low
Confidence
85% confidence
Finding
This markdown file documents installation steps that download runtime/model archives from GitHub, extract them into local directories, and instruct the user to write paths into the active OpenClaw config file. While the steps are described functionally, there is no explicit user warning about these filesystem changes or the fact that external artifacts are fetched and stored locally.

Static analysis

No suspicious patterns detected.