T08 · Insecure Dependencies
Warning
- Location
SKILL.md:37- Finding
Unverified FFmpeg Binary Download from a Third-Party Distribution Source
- Content
View full analysis
- Remediation
View remediation
Security audit
Ms Speech Synth
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent text-to-speech tool, but it needs Review because it can run an unverified ffmpeg binary from a predictable shared temporary path and sends input text to Microsoft Edge TTS.
Review before installing. Use a trusted system ffmpeg or pass an explicit trusted --ffmpeg path, do not follow the /tmp curl download guidance, and avoid sending confidential or regulated text because synthesis uses Microsoft Edge TTS. Run it only in an environment where temporary audio files and user-level subprocess execution are acceptable.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/ms_tts_chunked_bgm.py:87- Finding
Automatic Execution of a Predictable FFmpeg Binary from Shared Temporary Storage
- Content
View full analysis
str | None: paths = [ '/tmp/ffmpeg_bin/ffmpeg', '/usr/local/bin/ffmpeg', '/opt/homebrew/bin/ffmpeg', '/usr/bin/ffmpeg', ] for p in paths: if os.path.isfile(p) and os.access(p, os.X_OK): return p return None ``` Execution during BGM mixing at `scripts/ms_tts_chunked_bgm.py:346-364`: ```python command = [ ffmpeg_path, '-y', '-i', voice_wav_path, *bgm_input_args, '-i', bgm_path, '-filter_complex', filter_complex, '-map', '[mix]', '-b:a', '192k', output_mp3_path, ] completed = subprocess.run(command, capture_output=True, text=True) ``` Execution during ordinary conversion at `scripts/ms_tts_chunked_bgm.py:420-425`: ```python if ffmpeg_path and os.path.exists(ffmpeg_path): subprocess.run([ ffmpeg_path, '-y', '-i', wav_path, '-b:a', '192k', mp3_path ], capture_output=True) ``` ### Technical Analysis The executable discovery routine prioritizes `/tmp/ffmpeg_bin/ffmpeg` over system installation paths. `/tmp` is normally shared among local users and processes, and `/tmp/ffmpeg_bin/ffmpeg` is a fixed, predictable location. The validation consists only of checking that the path is a regular file and executable. It does not verify: - Ownership of the file or parent directory. - Whether another user can modify the file or directory. - A trusted cryptographic digest. - Whether the path or any parent component involves a symbolic link. - Whether the file is the expected FFmpeg executable. Although `subprocess.run()` uses an argument list and is not vulnerable to shell metacharacter ...[truncated 1607 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ms_tts_chunked_bgm.py:170- Finding
Predictable Intermediate Audio Files Created in Shared Temporary Storage
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation instructs use of file access and shell execution but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution model where an agent may invoke filesystem and shell capabilities without clear limitation, increasing the risk of unintended command execution or access to sensitive files when the skill is used.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill sends user-provided text to Microsoft's Edge TTS service over the network, but the documentation does not clearly disclose this data transfer. Users may provide sensitive notes, documents, or markdown content under the assumption processing is local, causing unintended exposure of private or regulated data to a third-party service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description states the skill converts arbitrary-length Chinese text and the documented defaults and examples are centered on Chinese voices and Chinese-only processing. This creates a locale-specific constraint without an explicit opt-in or justification that the skill is intentionally region/language scoped.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The documentation recommends downloading and unpacking ffmpeg via curl from an unspecified external URL directly into a temporary directory. This encourages execution of externally fetched binaries without integrity verification or pinned source validation, which can lead to supply-chain compromise or arbitrary code execution if the download source is tampered with or replaced.
- Content
md |------|------|------| | `edge-tts` | `pip3 install edge-tts` | 微软 TTS 引擎 | | `miniaudio` | `pip3 install miniaudio` | MP3 解码为 PCM | | `ffmpeg` | `curl -L .../ffmpeg.zip -o /tmp/ffmpeg.zip && unzip /tmp/ffmpeg.zip -d /tmp/ffmpeg_bin` | WAV 转 MP3、BGM 混音 | ## 速率限制（Rate Limit）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill sends supplied text to Microsoft's Edge TTS service via edge_tts.Communicate without any clear user-facing disclosure that content leaves the local environment. If users process sensitive notes, documents, or folder contents, this can cause unintended data exposure to a third-party service and violate privacy or compliance expectations.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python output_mp3_path, ] completed = subprocess.run(command, capture_output=True, text=True) if completed.returncode != 0: stderr = (completed.stderr or '').strip() raise RuntimeError(f'ffmpeg bgm mix failed: {stderr[:400]}')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python if ffmpeg_path is None: print('[MS-TTS-BGM] Warning: ffmpeg not found, outputting WAV instead.') print('[MS-TTS-BGM] Install ffmpeg: curl -L https://evermeet.cx/ffmpeg/getrelease/ffmpeg/zip -o /tmp/ffmpeg.zip && unzip /tmp/ffmpeg.zip -d /tmp/ffmpeg_bin') if bgm_path: raise RuntimeError('ffmpeg is required when --bgm is provided.')
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python return wav_result if ffmpeg_path and os.path.exists(ffmpeg_path): subprocess.run([ ffmpeg_path, '-y', '-i', wav_path, '-b:a', '192k', mp3_path ], capture_output=True)