Security audit

Voice Clone Bot

Security checks for vulnerabilities and agentic risk

Overview

This voice-cloning skill is purpose-aligned overall, but it has under-scoped automatic installation, local service, path, and cleanup behaviors that users should review before installing.

Install only if you explicitly want local voice cloning and are comfortable with large model downloads, a background local service, unpinned third-party code installation, and handling voice samples as biometric data. Use it only with the speaker's permission, keep the service bound to 127.0.0.1, avoid untrusted .env files, and review cleanup behavior before running the uninstaller.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run_tts.sh:8
Finding: Arbitrary Shell Command Execution Through Unsafe Environment File Loading
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server/app.py:56
Finding: Unauthenticated TTS API Accepts Arbitrary Server-Local Input and Output Paths
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: server/requirements.txt:1
Finding: Automatic Installation of Unpinned Packages and Mutable Git Repositories
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/uninstall.sh:39
Finding: Uninstaller Can Terminate and Delete Resources Not Owned by the Skill
Content: View full analysis
/dev/null || echo "") if [ -n "$PIDS" ]; then kill -9 $PIDS 2>/dev/null || true echo " ✓ 已关闭端口 $TTS_SERVER_PORT 的进程 (PID: $PIDS)" else echo " - 端口 $TTS_SERVER_PORT 未被占用" fi pkill -f "python app.py" 2>/dev/null && echo " ✓ 已清理残留 app.py 进程" || true # 清理守护日志 rm -f server/daemon_server.log # 清理生成的临时音频 rm -rf server/generated_audio ``` The registration cleanup removes either a symlink or a real directory recursively: ```bash echo "" echo "[4/5] 卸除 OpenClaw 技能注册..." SKILL_LINK="$HOME/.openclaw/skills/voice-clone-bot" if [ -L "$SKILL_LINK" ] || [ -d "$SKILL_LINK" ]; then rm -rf "$SKILL_LINK" echo " ✓ 已拔除技能注册: $SKILL_LINK" else echo " - 未找到技能注册" fi ``` ### Technical Analysis The process cleanup assumes that every process bound to `TTS_SERVER_PORT` belongs to this Skill. It does not inspect the executable path, command line, process owner, or project directory before issuing `SIGKILL`. If another application occupies the configured port, that unrelated application is terminated. The fallback `pkill -f "python app.py"` is also not scoped to this repository. Any process with a matching command line may be killed, including unrelated Python applications. The registration path is expected to be a symlink created by the installer, but the condition also accepts a normal directory. `rm -rf` then recursively deletes that directory without verifying that it is the Skill-created symlink or that it resolves to this project. ### Attack Path Process-termination path: 1. An unrelated service listens on the ...[truncated 927 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (79)

Tainted flow: 'target_url' from os.getenv (line 84, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/tts_client.py (reported line 95)May include surrounding context.
python
} try: resp = requests.post(target_url, json=payload, timeout=timeout_sec) resp.raise_for_status() data = resp.json()

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims consistent voice cloning from reference audio, but available backends may not all support cloning or may behave inconsistently depending on environment configuration. In a biometric context, this mismatch is risky because users and operators may believe consented cloning is happening under controlled conditions when the system may instead generate generic or incorrect audio output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims consistent voice cloning from reference audio, but available backends may not all support cloning or may behave inconsistently depending on environment configuration. In a biometric context, this mismatch is risky because users and operators may believe consented cloning is happening under controlled conditions when the system may instead generate generic or incorrect audio output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims consistent voice cloning from reference audio, but available backends may not all support cloning or may behave inconsistently depending on environment configuration. In a biometric context, this mismatch is risky because users and operators may believe consented cloning is happening under controlled conditions when the system may instead generate generic or incorrect audio output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims consistent voice cloning from reference audio, but available backends may not all support cloning or may behave inconsistently depending on environment configuration. In a biometric context, this mismatch is risky because users and operators may believe consented cloning is happening under controlled conditions when the system may instead generate generic or incorrect audio output.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill claims consistent voice cloning from reference audio, but available backends may not all support cloning or may behave inconsistently depending on environment configuration. In a biometric context, this mismatch is risky because users and operators may believe consented cloning is happening under controlled conditions when the system may instead generate generic or incorrect audio output.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation guidance is broad enough to trigger on ordinary conversational or audio-related contexts, which can cause the agent to invoke a shell/network-capable skill more often than necessary. Over-broad activation increases exposure to privacy-sensitive voice data handling and unnecessary execution of auto-installing or host-modifying behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Voice recordings are biometric identifiers, and the skill encourages cloning a user's voice without any warning about consent, retention, secondary use, or privacy risks. In this context, omission of consent guidance is especially dangerous because misuse can enable impersonation, fraud, and non-consensual synthesis of a person's identity-bearing voice.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The 'When to use this skill' section uses ambiguous, context-based criteria instead of narrow triggers, making accidental invocation likely. In this skill, accidental invocation is more dangerous because it may process biometric audio and initiate installation or backend startup without a clearly expressed user request.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage flow tells the operator to select and reuse user audio files for cloning, but it provides no safeguards around consent, minimization, retention, or purpose limitation. This makes it easy to repurpose previously submitted audio for impersonation or other unintended uses without the user's informed agreement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The installer provisions a TTS backend that the script itself admits does not support zero-shot voice cloning, while the skill is advertised as cloning a user's voice from reference audio. In a security-sensitive voice context, this mismatch can mislead operators and users into believing biometric voice-cloning functionality exists, undermining consent, trust, and policy controls around impersonation-capable features.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/architecture.md (reported line 39)May include surrounding context.
md
CDIR="$(cd "$(dirname "$0")/.." && pwd)" cd "$CDIR" # 0. Load optional runtime config from .env CONFIG_FILE="${TTS_CONFIG_FILE:-$CDIR/.env}" if [ -f "$CONFIG_FILE" ]; then set -a

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install_cosyvoice.sh (reported line 46)May include surrounding context.
sh
CDIR="$(cd "$(dirname "$0")/.." && pwd)" cd "$CDIR" # 0. Load optional runtime config from .env CONFIG_FILE="${TTS_CONFIG_FILE:-$CDIR/.env}" if [ -f "$CONFIG_FILE" ]; then set -a

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/run_tts.sh (reported line 8)May include surrounding context.
sh
CDIR="$(cd "$(dirname "$0")/.." && pwd)" cd "$CDIR" # 0. Load optional runtime config from .env CONFIG_FILE="${TTS_CONFIG_FILE:-$CDIR/.env}" if [ -f "$CONFIG_FILE" ]; then set -a

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tts_client.py (reported line 81)May include surrounding context.
python
CDIR="$(cd "$(dirname "$0")/.." && pwd)" cd "$CDIR" # 0. Load optional runtime config from .env CONFIG_FILE="${TTS_CONFIG_FILE:-$CDIR/.env}" if [ -f "$CONFIG_FILE" ]; then set -a

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/app.py (reported line 11)May include surrounding context.
python
CDIR="$(cd "$(dirname "$0")/.." && pwd)" cd "$CDIR" # 0. Load optional runtime config from .env CONFIG_FILE="${TTS_CONFIG_FILE:-$CDIR/.env}" if [ -f "$CONFIG_FILE" ]; then set -a

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script sources a configuration file from TTS_CONFIG_FILE or .env using shell source, which executes arbitrary shell code in that file rather than merely parsing key/value settings. Because environment variables can redirect CONFIG_FILE to any path, anyone who can influence that file or variable can achieve code execution when the uninstall script is run.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 55)May include surrounding context.
sh
pkill -f "python app.py" 2>/dev/null && echo " ✓ 已清理残留 app.py 进程" || true # 清理守护日志 rm -f server/daemon_server.log # 清理生成的临时音频 rm -rf server/generated_audio

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 57)May include surrounding context.
sh
# 清理守护日志 rm -f server/daemon_server.log # 清理生成的临时音频 rm -rf server/generated_audio # ----------------------------------------------- # 2. 按模式清理引擎源码

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/tts_client.py (reported line 14)May include surrounding context.
python
在 server/app.py 直接运行时，自动回填项目根目录 .env 中的配置。 """ repo_root = Path(__file__).resolve().parent.parent env_path = Path(os.getenv("TTS_CONFIG_FILE", str(repo_root / ".env"))) if not env_path.exists(): return

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/app.py (reported line 14)May include surrounding context.
python
在 server/app.py 直接运行时，自动回填项目根目录 .env 中的配置。 """ repo_root = Path(__file__).resolve().parent.parent env_path = Path(os.getenv("TTS_CONFIG_FILE", str(repo_root / ".env"))) if not env_path.exists(): return

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The ChatTTS backend ignores ref_audio entirely despite the skill promising voice cloning from a user reference sample. In this context, that is a security-relevant integrity issue because users may believe the system is operating on their supplied biometric sample in a specific way when it is not, undermining consent, auditability, and expected behavior for a sensitive voice-cloning feature.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The OpenVoice backend claims to do base TTS generation followed by tone-color conversion, but the code never generates the intermediate source speech before conversion. As written, it attempts conversion on an empty temp path, creating unsafe and misleading behavior in a biometric voice-cloning context where incorrect implementation can produce unpredictable outputs and bypass expected safeguards or provenance controls.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exposes capabilities to read files, access environment variables, invoke shell commands, and use the network, yet it declares no explicit tool scope or permission boundaries. In a skill that auto-installs software and handles user-provided paths, this increases the chance of unintended command execution, host modification, or data access beyond the stated purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.