Audio Speaker Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it enables voice cloning and speaker verification without enough consent, privacy, third-party upload, or authentication-safety guidance.

Review this skill carefully before installing. Only use it with voices you are authorized to process or clone, treat audio samples and similarity results as sensitive biometric data, review ElevenLabs and Hugging Face privacy/retention terms before uploading, avoid using these scores as the sole basis for real authentication decisions, and pass Hugging Face credentials through a protected environment variable rather than --token. Run setup in an unprivileged environment because dependencies are unpinned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_venv.sh:45
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `scripts/setup_venv.sh`, lines 45-56 **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Upgrade pip echo "Upgrading pip..." pip install --quiet --upgrade pip # Install PyTorch with MPS support (Metal Performance Shaders for Apple Silicon) echo "Installing PyTorch with MPS support..." pip install --quiet torch torchvision torchaudio # Install audio processing libraries echo "Installing audio processing libraries..." pip install --quiet \ demucs \ pyannote.audio \ pydub \ resemblyzer \ librosa ``` ### Technical Analysis The setup script installs the latest available versions of multiple packages and their transitive dependencies without version constraints, cryptographic hashes, or a reviewed lockfile. It also upgrades `pip` to an unspecified version. Consequently, the effective code installed and executed by this script can change after the project has been audited. Python package installation may execute package build logic and subsequently imports package code during normal operation. A compromised package release, malicious transitive dependency, or unexpected incompatible release could therefore introduce attacker-controlled code into the virtual environment. The reviewed package names appear consistent with the declared audio-processing functionality; no dependency-confusion or typosquatting package was identified in the project itself. The risk arises from unrestricted and non-reproducible package resolution. ### Attack Path 1. An attacker compromises a direct or transitive dependency distribution channel or publishes a malicious version that satisfies unrestricted dependency resolution. 2. A user runs `bash scripts/setup_venv.sh`. 3. `pip` resolves the mutable latest package set and downloads the affected artifact. 4. Malicious build or installation logic may execute d ...[truncated 760 chars]
• Remediation: ## Remediation Suggestions 1. Create a reviewed dependency lockfile containing exact versions for direct and transitive dependencies. 2. Require cryptographic hashes for every resolved artifact, for example: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Pin the installer tooling rather than upgrading `pip` to an unrestricted latest release. 4. Generate lockfiles separately for supported platforms where PyTorch artifacts differ. 5. Periodically update dependencies through a controlled review process that includes vulnerability scanning and compatibility tests. 6. Run setup under an unprivileged account and never with `sudo`. 7. Where practical, use a trusted internal package mirror and restrict package-index configuration to prevent dependency substitution.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/diarize_and_slice_mps.py:64
• Finding: Hugging Face Access Token Can Be Supplied Through Process Arguments## Vulnerability Details **File Location**: `scripts/diarize_and_slice_mps.py`, lines 64-78 **Vulnerability Type**: Secret exposure through command-line arguments **Risk Level**: Medium ### Vulnerable Code ```python def main() -> None: ap = argparse.ArgumentParser() ap.add_argument("--input", required=True, help="Input audio file (wav preferred)") ap.add_argument("--outdir", required=True) ap.add_argument("--token", default=os.environ.get("HF_TOKEN") or os.environ.get("HUGGINGFACE_TOKEN")) ap.add_argument("--prefix", default=None, help="Prefix for exported files (e.g., Podcast)") ap.add_argument("--min-speakers", type=int, default=None) ap.add_argument("--max-speakers", type=int, default=None) ap.add_argument("--pad-ms", type=int, default=80, help="Pad each segment on both sides (ms)") ap.add_argument("--device", default="mps", help="Torch device to run on (default: mps)") args = ap.parse_args() if not args.token: raise SystemExit("Missing HF token. Provide --token or set HF_TOKEN.") ``` The script's module example also explicitly demonstrates this unsafe interface at line 9: ```python python diarize_and_slice_mps.py --input vocals.wav --outdir out --token $HF_TOKEN --prefix MyShow ``` ### Technical Analysis Secrets supplied as command-line arguments may be exposed through process inspection facilities, diagnostic tooling, command logging, shell history, terminal capture, job metadata, or process-monitoring agents. Expanding `$HF_TOKEN` in the demonstrated command places the token value directly into the spawned process's argument vector. This implementation contradicts the security guidance in `SKILL.md`, which tells users to pass the token only through the `HF_TOKEN` environment variable and never as a command-line argument. The parser and missing-token error nevertheless advertise and accept `--token`, making insecure use likely. The token is sub ...[truncated 1401 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `--token` command-line option entirely. 2. Read the credential exclusively from `HF_TOKEN`, failing safely when it is absent: ```python token = os.environ.get("HF_TOKEN") if not token: raise SystemExit("Missing HF_TOKEN environment variable.") ``` 3. Remove the `HUGGINGFACE_TOKEN` alias unless backward compatibility specifically requires it, reducing the number of secret sources that must be managed. 4. Replace the unsafe module example with environment-based injection: ```bash HF_TOKEN="$HF_TOKEN" python scripts/diarize_and_slice_mps.py \ --input vocals.wav --outdir out --prefix MyShow ``` 5. Ensure CI systems and process supervisors inject the token through protected secret facilities and redact it from logs. 6. Use a narrowly scoped, read-only Hugging Face token with only the repository access required by the diarization workflow. 7. Revoke and rotate any token previously passed through command-line arguments if process or command logs may have retained it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs users to run shell commands, use environment variables for secrets, and write outputs to disk, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch can cause overbroad execution in host agents, making it harder to constrain shell, filesystem, and secret-handling behavior and increasing the risk of unintended command execution or data exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly supports speaker verification and voice cloning, which are high-risk biometric and impersonation workflows, yet it provides no consent, privacy, or anti-misuse guidance. In this context, omission of safeguards materially increases the chance of non-consensual voice cloning, unauthorized biometric processing, or deceptive identity use.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The ElevenLabs workflow tells users to upload a voice sample to a third-party service without warning that the audio leaves the local environment or may be retained and processed externally. Because the sample is a voice biometric and may contain personal data, the missing disclosure can lead to privacy violations, policy noncompliance, and unintentional external sharing of sensitive audio.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This guidance provides operational instructions for creating and optimizing voice clones without any consent, privacy, or misuse safeguards. In a skill explicitly intended for voice cloning and speaker verification, omission of warnings and authorization requirements materially increases the risk of impersonation, non-consensual cloning, and privacy abuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide provides concrete voice authentication thresholds and usage recommendations without warning that voice data is biometric information and that speaker verification can create privacy, consent, and misuse risks. In this skill’s context—speaker verification and voice cloning—omitting those warnings makes unsafe or noncompliant deployment more likely, especially where users may infer the thresholds are suitable for production identity decisions.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script performs speaker verification on user-supplied audio and produces an identity-likeness verdict, but it provides no warning about biometric sensitivity, consent requirements, or the risk of misuse for identity inference. In the context of a skill explicitly intended for speaker verification and voice cloning workflows, that omission can enable unsafe handling of biometric data and overconfident operational use.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-vn",
        dst,
    ]
    subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)


def _ensure_torchaudio_compat_shim() -> None:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.