qwencloud-audio-tts

• Outcome: Review
• Latest audit: May 28, 2026 · 11:35 AM UTC
• Version: 0.2.1

Overview

This TTS skill mostly does what it advertises, but it also adds mandatory update-management behavior that can run another local skill and write persistent state outside the audio task.

Install only if you are comfortable using a QwenCloud/DashScope API key and sending synthesis text, and possibly voice samples, to that service. Review any update-check prompt before approving it, inspect the separate qwencloud-update-check skill before installing it, avoid custom `QWEN_BASE_URL` values unless you trust the endpoint, and approve agent config edits only if you want persistent QwenCloud skill registration.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not script.is_file():
                return
            try:
                proc = subprocess.run(
                    [sys.executable, str(script), "--print-response"],
                    capture_output=True, text=True, timeout=15,
                )

• Confidence: 91% confidence
• Finding: This code executes another Python script discovered from repository-controlled paths using subprocess. Even though it avoids shell injection by passing an argument list, it still transfers code-execution trust to an external script inside the repo or .agents directory, so a tampered or untrusted check_update.py would run automatically when this helper is invoked.

Tainted flow: 'req' from os.getenv (line 687, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

"""Download a file from *url* to *dest*, creating parent dirs as needed."""
    dest.parent.mkdir(parents=True, exist_ok=True)
    req = urllib.request.Request(url, headers={"User-Agent": "qwencloud-ai/1.0"})
    with urllib.request.urlopen(req, timeout=timeout) as resp:
        dest.write_bytes(resp.read())
    return dest

• Confidence: 83% confidence
• Finding: download_file fetches an arbitrary URL and writes the response directly to a caller-chosen filesystem path without any validation, size checks, or destination restrictions. In an agent context, this enables SSRF-style internal network access and unsafe file writes if untrusted input can reach this helper.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill directs the agent to use environment variables, read/write local files, invoke shell commands, and access the network, but no explicit permissions are declared. This creates a mismatch between apparent trust boundaries and actual behavior, increasing the chance that an agent or reviewer will approve broader access than intended without informed consent.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill makes post-execution update management mandatory and instructs the agent to install or interact with a separate update-check skill before responding to the user. Embedding unrelated operational control flow inside a TTS skill expands scope beyond speech synthesis and can coerce additional code execution and package installation in contexts where the user only asked for TTS.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill directs execution of local maintenance commands such as `gossamer.py --dismiss` and `--never-install`, which alter local state but are not necessary for speech synthesis. This creates an unnecessary mechanism for persistent state changes and preference manipulation that could suppress future warnings or modify agent behavior outside the user's requested task.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill directs execution of local maintenance commands such as `gossamer.py --dismiss` and `--never-install`, which alter local state but are not necessary for speech synthesis. This creates an unnecessary mechanism for persistent state changes and preference manipulation that could suppress future warnings or modify agent behavior outside the user's requested task.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file instructs the agent to scan for sibling skills and register them in user configuration files, which extends behavior well beyond the stated TTS purpose of the skill. This creates an unnecessary mechanism for persistence and expansion of agent behavior, and could cause unrelated capabilities to be silently activated in future sessions.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The instructions tell the agent to modify or create user/agent config files, including appending a block that changes future agent behavior. For a text-to-speech skill, persistent configuration edits are not necessary to fulfill the user task, so this creates avoidable risk of unauthorized state changes, unwanted persistence, and broader skill activation than the user intended.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The file implements update prompting, installation guidance, and suppression-state management, which is unrelated to the stated text-to-speech purpose of the skill. Capability creep like this is dangerous because it introduces hidden behavior that can influence the host environment and user decisions without being necessary for TTS functionality.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Executing a separate update-check script is not justified by a TTS skill and expands the attack surface beyond the advertised function. In this context, the mismatch makes the behavior more suspicious because users invoking a text-to-speech capability would not reasonably expect it to run auxiliary code from another skill directory.

Context-Inappropriate Capability

Medium

• Confidence: 72% confidence
• Finding: Supporting arbitrary provider names and custom base URLs allows requests and bearer tokens to be sent to non-Qwen endpoints when environment variables are manipulated. In an agent/skill setting, that expands the trust boundary and can lead to credential exfiltration or unexpected data transfer if deployment environments are not tightly controlled.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guide includes a voice-cloning workflow that uploads a local audio sample to a remote service, but it omits any warning about consent, biometric/privacy sensitivity, retention, or legal restrictions. Because voice samples are personally identifying and can enable impersonation or misuse, documentation that normalizes upload without safeguards can lead users to process third-party voices unlawfully or unsafely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide instructs users to send requests to an external API using an environment-stored credential but provides no explicit warning that text input and API metadata will be transmitted to a third-party service. In a skill execution context, this can cause users or downstream agents to exfiltrate sensitive content or use credentials without informed consent.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The instructions tell the user to download output to `output.wav` without warning that this creates or overwrites a local file. While limited in impact, unattended execution or repeated runs can clobber existing files or create artifacts on disk unexpectedly.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The helper downloads remote content and writes it locally with no user-facing notice, destination guardrails, or trust validation. In an agent workflow, silent persistence of remote data can be abused to plant files, overwrite expected artifacts, or stage later processing of attacker-controlled content.

Static analysis

No suspicious patterns detected.