Security audit

Slice

Security checks across malware telemetry and agentic risk

Overview

VoxFlow’s media features fit its purpose, but the skill also tells agents to change installed tooling and submit GitHub issues without clear user confirmation.

Install only if you are comfortable using a VoxFlow account, quota-based cloud media processing, and local token storage. Before use, override the skill’s automatic maintenance behavior: require confirmation before upgrades, do not run unpinned latest installs or bulk skill installs automatically, and review any GitHub issue body and system details before submitting.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The hub instructs the agent to perform unattended global upgrades and even fall back to `npm i -g voxflow@latest && voxflow skills install --all` without user approval. This expands the skill from media processing into autonomous system modification and arbitrary package retrieval, creating supply-chain and host-integrity risk if the upgrade path, registry, or installed skills are compromised.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill directs the agent to file GitHub issues on the user's behalf, including command details and automatically appended system information. That is an external side effect outside the core voice/video task and can disclose sensitive workflow, file, environment, or system metadata to a third party without clear confirmation.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly tells the agent to modify the user's system immediately and without asking, including global package installation. Lack of a user-facing warning or consent for these host changes is dangerous because it normalizes silent software changes and increases the blast radius of any compromised update source or malicious hint output.

Missing User Warnings

High

Confidence: 95% confidence
Finding: Automatic bug filing can transmit error output, command lines, and appended system info to GitHub without a privacy review. In a media-processing context, failures may include local paths, filenames, URLs, or other user data, so silent external reporting materially increases data-leak risk.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill explicitly shows commands that generate `.wav`, `.txt`, and `.podcast.json` outputs but does not clearly warn the user that files will be written to the local filesystem. This can cause accidental disclosure of sensitive prompts, generated dialogue, or metadata on shared machines or in synced directories, though the impact is limited because file creation is central to the tool's expected function.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill requires `voxflow login` and describes cloud-backed script generation and TTS, but it does not disclose that topics, scripts, audio, or edited podcast JSON may be transmitted to a remote service for processing. In a voice/AI workflow, users may submit confidential text or media, so the lack of a privacy/data-handling warning materially increases the risk of unintended data exposure.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly supports sending local files, remote URLs, and microphone/video content to Tencent cloud and Azure batch services, but it does not give a prominent privacy/security warning about transmitting potentially sensitive audio/video off-device. In an agent context, users may assume transcription is local or may not realize remote URLs and recordings are uploaded to third-party providers, creating confidentiality and compliance risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The publish webhook mode instructs users or agents to POST artifact metadata to an arbitrary external URL, but the documentation does not prominently warn that data will leave the local/system boundary. In an orchestrated or automated workflow, this can leak file paths, URLs, sizes, durations, and publication endpoints to attacker-controlled infrastructure if the webhook target is untrusted or user-controlled.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly states that image generation produces a local PNG plus a COS URL, which implies user prompts and generated media may be transmitted to remote services and made accessible via externally hosted storage. Because the skill also accepts arbitrary user text and URLs elsewhere in the workflow without any privacy warning or consent language, users may unknowingly send sensitive content to third-party infrastructure.

VirusTotal

1/65 vendors flagged this skill as malicious, and 64/65 flagged it as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.