ClawHub
Back to skill

Security audit

zhz-tts

Security checks for vulnerabilities and agentic risk

Overview

This speech tool needs review because it automatically loads saved API keys and can send them to an unchecked server address.

Both engines send your chosen text to external services, so consider document sensitivity. Before using DashScope, review its automatic key-file lookup and use only an approved HTTPS endpoint with a dedicated key. Download destinations should also be restricted before running in environments with sensitive internal services. Actual local configuration and installed dependency contents were unavailable. These concrete credential and destination concerns justify Review; the artifacts do not establish malicious intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'url' from os.getenv (line 90, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
93% confidence
Finding

The configurable base URL receives both the synthesis text and the Authorization header containing the DashScope API key, without destination or HTTPS validation. If an attacker can influence this configuration, they can redirect credentials and text to their server; an HTTP endpoint also exposes them in transit. The default endpoint is HTTPS, so exploitation requires configuration influence rather than ordinary text input.

Content

Scanner excerpt · scripts/main.py (reported line 112)May include surrounding context.

python
print(f"正在合成语音（DashScope {model}，音色：{voice}）...")

    try:
        response = requests.post(url, headers=headers, json=body, timeout=120)
    except Exception as e:
        raise RuntimeError(f"网络请求失败：{e}")

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The text-to-speech workflow lacks a warning that input text is transmitted to third-party services.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The examples encourage converting articles and notes without explicitly explaining that their text leaves the machine for processing by Microsoft or Alibaba services. Although the provider names offer some indication, an agent could transmit confidential document contents without the user understanding or authorizing that disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/main.py (reported line 112)May include surrounding context.

python
print(f"正在合成语音（DashScope {model}，音色：{voice}）...")

    try:
        response = requests.post(url, headers=headers, json=body, timeout=120)
    except Exception as e:
        raise RuntimeError(f"网络请求失败：{e}")

Tainted flow: 'body' from sys.stdin.read (line 92, user input) → requests.post (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/main.py (reported line 112)May include surrounding context.

python
print(f"正在合成语音（DashScope {model}，音色：{voice}）...")

    try:
        response = requests.post(url, headers=headers, json=body, timeout=120)
    except Exception as e:
        raise RuntimeError(f"网络请求失败：{e}")

Tainted flow: 'audio_url' from requests.post (line 121, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
94% confidence
Finding

The API-provided audio URL is fetched after only a scheme check, and requests follows redirects by default. A malicious or compromised API endpoint could direct the agent host to internal services or metadata endpoints and save their responses as audio, creating an SSRF primitive. Exploitation requires influence over the API response or download redirect chain.

Content

Scanner excerpt · scripts/main.py (reported line 132)May include surrounding context.

python
if audio_url.startswith("http://") or audio_url.startswith("https://"):
        try:
            audio_response = requests.get(audio_url, timeout=60)
        except Exception as e:
            raise RuntimeError(f"下载音频失败：{e}")
        if audio_response.status_code != 200:

DashScope synthesis does not apply the manifest's promised automatic 0.9× speed for English listening practice.

Low
Category
Excessive Agency
Confidence
99% confidence
Finding

The manifest promises automatic 0.9× playback speed for English listening practice, and L320–L333 compute and announce that setting. However, the DashScope call at L360 does not pass the rate, and its request body at L92–L101 contains no speed setting, so this engine does not implement the advertised behavior.

Content

No source excerpt is available for this finding.