Kid Point Voice Component

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

This voice skill uses documented cloud speech services and local audio playback in ways that match its stated purpose, with privacy and dependency caveats users should understand.

Install only if you are comfortable sending speech text or audio to SenseAudio and, for non-Chinese TTS, Microsoft Edge TTS. Avoid using sensitive recordings or confidential text, configure SENSE_API_KEY deliberately, prefer a virtual environment with pinned Python dependencies, and do not run optional player-install commands with sudo unless you trust and need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:13

Finding

Unpinned and Ecosystem-Mismatched Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/setup.sh:13-15, README.md:21-24, package.json:37-40
Vulnerability Type: Uncontrolled third-party dependency resolution and package ecosystem mismatch
Risk Level: Medium

Vulnerable Code

scripts/setup.sh:13-15:

bash

# Install requests library (the only dependency)
echo "📦 Installing Python dependencies..."
pip3 install requests --quiet

README.md:21-24:

bash

pip install edge-tts  # English/Japanese TTS
pip install requests  # SenseAudio HTTP calls

package.json:37-40:

json

"dependencies": {
  "requests": "^2.31.0",
  "edge-tts": "^6.1.0"
},

Technical Analysis

The installation instructions resolve Python packages from an external package index without exact version pins or cryptographic hashes. The effective code installed can therefore change over time without any modification to the reviewed Skill.

The project also declares requests and edge-tts in the npm dependencies section, even though the executable scripts import Python modules. npm and pip are separate package ecosystems: an npm dependency with the same name is not the Python package used by the scripts. Running npm installation may consequently download unrelated Node.js packages and execute any lifecycle scripts they define while failing to install the required Python dependencies.

No malicious dependency payload is embedded in the audited repository. This finding concerns avoidable supply-chain exposure and does not establish that the currently resolved packages are malicious.

Attack Path

1. A user runs scripts/setup.sh, follows the README commands, or runs npm installation based on package.json.
2. pip or npm resolves mutable package versions from its configured external registry.
3. An upstream release, compromised maintainer account, package-index substitution, malicious registry mirror, or unintended same-name npm p ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a Python requirements lock file containing exact, reviewed versions:

   text

   requests==<reviewed-version>
   edge-tts==<reviewed-version>
   

2. Generate and verify cryptographic hashes for every Python distribution, then install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Use a dedicated virtual environment rather than modifying the user's global Python installation:

   bash

   python3 -m venv .venv
   .venv/bin/python -m pip install --require-hashes -r requirements.txt
   

4. Remove the Python package names from the npm dependencies field. If the project has no Node.js runtime component, remove unnecessary npm dependency metadata entirely.

5. Update setup.sh and the README so that both install all required Python dependencies exclusively from the reviewed lock file.

6. Perform intentional dependency upgrades through a controlled review process, including package provenance, checksum, vulnerability, and maintainer-change checks.

7. Avoid running dependency installation as root or through sudo; use the minimum privileges required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Tainted flow: 'headers' from os.environ.get (line 58, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/asr.py (reported line 80)May include surrounding context.

python

data["target_language"] = translate_to
    
    try:
        response = requests.post(DEFAULT_ASR_URL, headers=headers, files=files, data=data, timeout=120)
        response.raise_for_status()
        
        result = response.json()

Tainted flow: 'headers' from os.environ.get (line 283, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tts.py (reported line 305)May include surrounding context.

python

}
    
    try:
        response = requests.post(DEFAULT_TTS_URL, headers=headers, json=payload, timeout=timeout)
        response.raise_for_status()
        
        data = response.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch specifically hides materially relevant behavior: local file access, audio file creation, subprocess-based playback, and use of Microsoft Edge TTS in addition to SenseAudio. Such discrepancies can bypass user expectations, policy checks, or enterprise approval processes, especially where data residency or tool restrictions matter.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch specifically hides materially relevant behavior: local file access, audio file creation, subprocess-based playback, and use of Microsoft Edge TTS in addition to SenseAudio. Such discrepancies can bypass user expectations, policy checks, or enterprise approval processes, especially where data residency or tool restrictions matter.

Content

No source excerpt is available for this finding.

Tainted flow: 'files' from open (line 63, file read) → requests.post (network output)

High

• Category: Data Flow
• Confidence: 80% confidence

Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/asr.py (reported line 80)May include surrounding context.

python

data["target_language"] = translate_to
    
    try:
        response = requests.post(DEFAULT_ASR_URL, headers=headers, files=files, data=data, timeout=120)
        response.raise_for_status()
        
        result = response.json()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file is entirely written in Chinese and presents the skill rename and migration guidance only in that language. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented behavior automatically routes content to different TTS providers based on detected language, which can change the destination of user data without explicit consent. This is dangerous because users may reasonably expect consistent handling, but Chinese text is sent to SenseAudio while English/Japanese goes to Edge, creating hidden privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to configure a third-party API key and describes HTTP-based TTS usage, but it does not clearly disclose that user-provided text and possibly audio may be transmitted to external providers. In a voice skill, this is a meaningful privacy and data-handling risk because users may input sensitive content without understanding that provider routing occurs off-device.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 129)May include surrounding context.

python tts.py --check-players

安装推荐播放器

sudo apt-get install alsa-utils # aplay (WAV 原生支持) sudo apt-get install pulseaudio # paplay sudo apt-get install ffmpeg # ffplay (多格式支持)

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documentation describes behavior that requires environment access, local file read/write, network access, and shell/subprocess execution, but it does not declare any tool scope or permissions. This creates a transparency and containment problem: users and hosting platforms cannot accurately evaluate or constrain what the skill is allowed to do before execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends user-provided text and potentially audio-related content to third-party cloud services, but the description does not present a prominent privacy warning or consent boundary. This can expose sensitive prompts, personal data, or confidential content to external providers without the user fully realizing it.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/asr.py (reported line 18)May include surrounding context.

python

import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/asr.py (reported line 50)May include surrounding context.

python

import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 25)May include surrounding context.

python

import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts.py (reported line 270)May include surrounding context.

python

import requests

# 默认配置
DEFAULT_ASR_URL = "https://api.senseaudio.cn/v1/audio/transcriptions"
DEFAULT_ASR_MODEL = "sense-asr-deepthink"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script transmits user-provided audio to an external cloud service but does not provide an explicit privacy or network-transmission warning at runtime. Because audio may contain sensitive spoken content, users may unknowingly disclose personal or confidential information to a third party.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes this skill as providing text-to-speech and speech recognition with automatic language switching. This ASR script additionally exposes a target-language translation capability by sending a "target_language" parameter, which is a distinct behavior not stated in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The user-facing comments and all echoed installation and usage messages are written in Chinese, which effectively forces a specific language for setup and operation guidance. The file does not offer an opt-in language choice or state that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 27)May include surrounding context.

sh

echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 400)May include surrounding context.

python

echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 527)May include surrounding context.

python

echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tts.py (reported line 528)May include surrounding context.

python

echo "   ✅ aplay 已安装"
else
    echo "   ⚠️  未找到音频播放器"
    echo "   建议安装：sudo apt-get install ffmpeg"
fi

# 验证 API Key

Static analysis

No suspicious patterns detected.