Audio Speaker Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:04 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it enables voice cloning and speaker verification without enough consent, privacy, third-party upload, or authentication-safety guidance.

Review this skill carefully before installing. Only use it with voices you are authorized to process or clone, treat audio samples and similarity results as sensitive biometric data, review ElevenLabs and Hugging Face privacy/retention terms before uploading, avoid using these scores as the sole basis for real authentication decisions, and pass Hugging Face credentials through a protected environment variable rather than --token. Run setup in an unprivileged environment because dependencies are unpinned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup_venv.sh:45

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: scripts/setup_venv.sh, lines 45-56
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Upgrade pip
echo "Upgrading pip..."
pip install --quiet --upgrade pip

# Install PyTorch with MPS support (Metal Performance Shaders for Apple Silicon)
echo "Installing PyTorch with MPS support..."
pip install --quiet torch torchvision torchaudio

# Install audio processing libraries
echo "Installing audio processing libraries..."
pip install --quiet \
    demucs \
    pyannote.audio \
    pydub \
    resemblyzer \
    librosa

Technical Analysis

The setup script installs the latest available versions of multiple packages and their transitive dependencies without version constraints, cryptographic hashes, or a reviewed lockfile. It also upgrades pip to an unspecified version.

Consequently, the effective code installed and executed by this script can change after the project has been audited. Python package installation may execute package build logic and subsequently imports package code during normal operation. A compromised package release, malicious transitive dependency, or unexpected incompatible release could therefore introduce attacker-controlled code into the virtual environment.

The reviewed package names appear consistent with the declared audio-processing functionality; no dependency-confusion or typosquatting package was identified in the project itself. The risk arises from unrestricted and non-reproducible package resolution.

Attack Path

1. An attacker compromises a direct or transitive dependency distribution channel or publishes a malicious version that satisfies unrestricted dependency resolution.
2. A user runs bash scripts/setup_venv.sh.
3. pip resolves the mutable latest package set and downloads the affected artifact.
4. Malicious build or installation logic may execute d ...[truncated 760 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency lockfile containing exact versions for direct and transitive dependencies.
2. Require cryptographic hashes for every resolved artifact, for example:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

3. Pin the installer tooling rather than upgrading pip to an unrestricted latest release.
4. Generate lockfiles separately for supported platforms where PyTorch artifacts differ.
5. Periodically update dependencies through a controlled review process that includes vulnerability scanning and compatibility tests.
6. Run setup under an unprivileged account and never with sudo.
7. Where practical, use a trusted internal package mirror and restrict package-index configuration to prevent dependency substitution.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/diarize_and_slice_mps.py:64

Finding

Hugging Face Access Token Can Be Supplied Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/diarize_and_slice_mps.py, lines 64-78
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

python

def main() -> None:
    ap = argparse.ArgumentParser()
    ap.add_argument("--input", required=True, help="Input audio file (wav preferred)")
    ap.add_argument("--outdir", required=True)
    ap.add_argument("--token", default=os.environ.get("HF_TOKEN") or os.environ.get("HUGGINGFACE_TOKEN"))
    ap.add_argument("--prefix", default=None, help="Prefix for exported files (e.g., Podcast)")
    ap.add_argument("--min-speakers", type=int, default=None)
    ap.add_argument("--max-speakers", type=int, default=None)
    ap.add_argument("--pad-ms", type=int, default=80, help="Pad each segment on both sides (ms)")
    ap.add_argument("--device", default="mps", help="Torch device to run on (default: mps)")
    args = ap.parse_args()

    if not args.token:
        raise SystemExit("Missing HF token. Provide --token or set HF_TOKEN.")

The script's module example also explicitly demonstrates this unsafe interface at line 9:

python

python diarize_and_slice_mps.py --input vocals.wav --outdir out --token $HF_TOKEN --prefix MyShow

Technical Analysis

Secrets supplied as command-line arguments may be exposed through process inspection facilities, diagnostic tooling, command logging, shell history, terminal capture, job metadata, or process-monitoring agents. Expanding $HF_TOKEN in the demonstrated command places the token value directly into the spawned process's argument vector.

This implementation contradicts the security guidance in SKILL.md, which tells users to pass the token only through the HF_TOKEN environment variable and never as a command-line argument. The parser and missing-token error nevertheless advertise and accept --token, making insecure use likely.

The token is sub ...[truncated 1401 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --token command-line option entirely.
2. Read the credential exclusively from HF_TOKEN, failing safely when it is absent:

   python

   token = os.environ.get("HF_TOKEN")
   if not token:
       raise SystemExit("Missing HF_TOKEN environment variable.")
   

3. Remove the HUGGINGFACE_TOKEN alias unless backward compatibility specifically requires it, reducing the number of secret sources that must be managed.
4. Replace the unsafe module example with environment-based injection:

   bash

   HF_TOKEN="$HF_TOKEN" python scripts/diarize_and_slice_mps.py \
     --input vocals.wav --outdir out --prefix MyShow
   

5. Ensure CI systems and process supervisors inject the token through protected secret facilities and redact it from logs.
6. Use a narrowly scoped, read-only Hugging Face token with only the repository access required by the diarization workflow.
7. Revoke and rotate any token previously passed through command-line arguments if process or command logs may have retained it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill instructs users to run shell commands, use environment variables for secrets, and write outputs to disk, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch can cause overbroad execution in host agents, making it harder to constrain shell, filesystem, and secret-handling behavior and increasing the risk of unintended command execution or data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly supports speaker verification and voice cloning, which are high-risk biometric and impersonation workflows, yet it provides no consent, privacy, or anti-misuse guidance. In this context, omission of safeguards materially increases the chance of non-consensual voice cloning, unauthorized biometric processing, or deceptive identity use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The ElevenLabs workflow tells users to upload a voice sample to a third-party service without warning that the audio leaves the local environment or may be retained and processed externally. Because the sample is a voice biometric and may contain personal data, the missing disclosure can lead to privacy violations, policy noncompliance, and unintentional external sharing of sensitive audio.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This guidance provides operational instructions for creating and optimizing voice clones without any consent, privacy, or misuse safeguards. In a skill explicitly intended for voice cloning and speaker verification, omission of warnings and authorization requirements materially increases the risk of impersonation, non-consensual cloning, and privacy abuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide provides concrete voice authentication thresholds and usage recommendations without warning that voice data is biometric information and that speaker verification can create privacy, consent, and misuse risks. In this skill’s context—speaker verification and voice cloning—omitting those warnings makes unsafe or noncompliant deployment more likely, especially where users may infer the thresholds are suitable for production identity decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This script performs speaker verification on user-supplied audio and produces an identity-likeness verdict, but it provides no warning about biometric sensitivity, consent requirements, or the risk of misuse for identity inference. In the context of a skill explicitly intended for speaker verification and voice cloning workflows, that omission can enable unsafe handling of biometric data and overconfident operational use.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/diarize_and_slice_mps.py (reported line 46)May include surrounding context.

python

"-vn",
        dst,
    ]
    subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)


def _ensure_torchaudio_compat_shim() -> None: