ClawHub
Back to skill

Security audit

Alibaba Cloud AI Audio CosyVoice Voice Design

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Alibaba Cloud CosyVoice request helper with disclosed third-party API use and local output files, but users should avoid putting sensitive text in prompts or evidence files.

Installers should understand that use of this skill may send prompt text and preview text to Alibaba Cloud and may save those values locally under the output directory. Do not include confidential, regulated, personal, or unauthorized voice-related content unless that handling is acceptable for your Alibaba Cloud account and environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documents local file read/write behavior via validation and evidence-generation steps, but it does not declare any explicit tool scope or permissions boundaries. This creates an authorization gap: an agent may use filesystem capabilities implicitly without clear user visibility or policy restriction, increasing the risk of unintended access or artifact persistence.

Session Persistence

Medium
Category
Rogue Agent
Content
# Model Studio CosyVoice Voice Design

Use the CosyVoice voice enrollment API to create designed voices from a natural-language voice description.

## Critical model names
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to send `voice_prompt` and `preview_text` to external Alibaba Cloud endpoints and to save request details and API response summaries locally, but it omits a clear privacy warning. Because these fields may contain sensitive personal data or biometric/voice-related information, users may unknowingly transmit and persist data outside their local environment.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The prompt explicitly instructs the skill to respond in Chinese (e.g. '请直接给我请求 JSON'), and similar Chinese-only phrasing appears throughout the eval set. Because this file is a JSON manifest-like file, SQP-3 applies, and the content constrains language without offering a user choice or documenting a justified locale-specific scope.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The notes state that `voice_prompt` and `preview_text` support only Chinese or English, which is a natural-language locale constraint. The file does not indicate that users can choose other locales or that this limitation is a justified region-specific policy, so it may conflict with language/locale choice requirements.

Static analysis

No suspicious patterns detected.