Security audit

Piper TTS

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local text-to-speech helper, but its setup script can make unprompted system-level changes and has avoidable file-handling risks, so it should be reviewed before installation.

Install only if you are comfortable with a setup script that can modify your Python environment, use Homebrew or sudo apt to install ffmpeg, and download unpinned packages and voice models. Review or harden the scripts first for confirmation prompts, pinned dependencies, voice-name validation, and private temporary files; avoid running setup with elevated privileges unless you have reviewed the exact commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: scripts/setup-piper.sh:20
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
/dev/null; then echo "📦 Installing piper-tts..." pip3 install piper-tts echo "✅ piper-tts installed" else ``` ### Technical Analysis The setup script installs `piper-tts` from the package index without specifying an audited version, using a lock file, or verifying package hashes. Consequently, the code installed by the Skill can change independently of the reviewed project. Python package installation can execute package build hooks and installs transitive dependencies. If a future package version or one of its dependencies is compromised, the installation process could execute attacker-controlled code with the privileges of the user running the setup script. The package name does not appear to be an evident typo or dependency-confusion target, so this finding concerns unsafe dependency resolution rather than evidence that the current package is malicious. ### Attack Path 1. An attacker compromises a future `piper-tts` release, one of its transitive dependencies, or the relevant package distribution account. 2. The target invokes `scripts/setup-piper.sh` on a system where Piper is not already available. 3. `pip3 install piper-tts` resolves the current mutable package and dependency versions. 4. Malicious package installation hooks or imported runtime code execute locally. 5. The payload receives the privileges and filesystem/network access of the user who ran the script. ### Impact Assessment Successful exploitation could permit arbitrary code execution as the invoking user. This may expose that user's files, environment variables, credentials, and network access. If the setup script is run through an elevated environment, the impact could extend to system-wide files an ...[truncated 22 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup-piper.sh:46
Finding: Path Traversal Through an Unvalidated Voice Name
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` - Explicitly reject `/`, backslashes, `..`, control characters, and leading hyphens. - Canonicalize the destination and verify that it remains beneath the canonical `VOICES_DIR`. - Download into a securely created temporary file and move it into place only after validation succeeds. - Use `curl --fail --show-error --location` so HTTP errors do not become model files. - Verify downloaded models against trusted checksums or signed metadata. - Use `curl` options that prevent indefinite transfers, such as connection and overall timeouts. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/piper-speak.sh:28
Finding: Predictable Files in a Shared Temporary Directory
Content: View full analysis
/dev/null # Convert to MP3 ffmpeg -y -loglevel error -i "$OUT_WAV" -codec:a libmp3lame -qscale:a 4 "$OUT_MP3" # Cleanup WAV rm -f "$OUT_WAV" # Output MP3 path (agent copies this into reply) echo "$OUT_MP3" ``` ### Technical Analysis The script stores output under a fixed directory in `${TMPDIR:-/tmp}` and derives filenames from a millisecond-resolution timestamp. It neither creates a private per-execution directory nor atomically reserves the output files. On a multi-user system, another local user may be able to predict the likely filename and create a symbolic link or conflicting file before Piper or FFmpeg opens it. The `ffmpeg -y` option explicitly permits overwriting an existing output. The script also does not set restrictive permissions for the directory or generated audio. This issue requires local access to the same temporary filesystem and a successful race or sufficiently accurate filename prediction. ### Attack Path 1. A local attacker observes or predicts when `piper-speak.sh` will run. 2. The attacker computes likely millisecond-based WAV and MP3 names under `/tmp/tts-piper`. 3. Before Piper or FFmpeg opens the predicted output, the attacker creates a symlink or preexisting file at that path. 4. Piper or `ffmpeg -y` opens the attacker-selected path. 5. If the relevant program follows the link, data is written to a different file writable by the victim. 6. Alternatively, the attacker can replace or corrupt generated audio ...[truncated 557 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to execute local shell scripts (scripts/setup-piper.sh and scripts/piper-speak.sh) but does not declare any tool scope or allowed-tools restrictions. This creates an authorization gap where a consumer may enable broader shell access than intended, increasing the risk of arbitrary command execution or unsafe setup behavior if the referenced scripts are modified, malicious, or handle untrusted input unsafely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs package installation and reaches a sudo path without any confirmation, dry-run mode, or prominent warning that it will modify the system. Users may execute it expecting harmless local setup, but it can trigger privileged changes and install software from external repositories automatically.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script can install system packages via Homebrew or apt-get, and on Debian-based systems it invokes sudo to modify the host. That is broader than simple TTS generation and creates avoidable system-modification and supply-chain risk if the script is run blindly or in an unexpected environment.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The presence of sudo means the script can escalate to privileged package installation, increasing blast radius if dependency sources are compromised or if the script is executed in the wrong context. In a skill advertised around local TTS, unexpected root-requiring behavior is especially sensitive because users may not anticipate system-level changes.
Content: Scanner excerpt · scripts/setup-piper.sh (reported line 36)May include surrounding context.
sh
if command -v brew &>/dev/null; then brew install ffmpeg elif command -v apt-get &>/dev/null; then sudo apt-get install -y ffmpeg else echo "⚠️ Please install ffmpeg manually" exit 1

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script sets a default voice of en_US-kusal-medium, which imposes a specific language/locale choice when the caller does not provide one. This is a natural-language policy concern because the skill does not offer explicit user choice or document why a US English default is required.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes the skill as providing local text-to-speech with 'no cloud APIs, no cost, no latency', which suggests an entirely local operation model. This setup script installs piper-tts via pip and downloads voice model files from Hugging Face over the network, so the implementation depends on remote retrieval for installation/setup even though runtime synthesis may be local.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.