ClawHub
Back to skill

Security audit

Lipvoice Tts

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a straightforward LipVoice API helper, with privacy and credential-handling cautions rather than evidence of malicious behavior.

Install only if you are comfortable sending reference audio, TTS text, and model metadata to LipVoice using your API key. Use only voices you have permission to clone, avoid confidential text or recordings unless authorized, protect the API key, verify output paths, and double-check the target audio-id before running delete.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'req' from os.environ.get (line 151, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
# 下载音频
                    try:
                        req = urllib.request.Request(voice_url, headers={'sign': API_KEY})
                        with urllib.request.urlopen(req, timeout=60) as response:
                            with open(output, 'wb') as f:
                                f.write(response.read())
                        print(f"✅ 合成完成！已保存到: {os.path.abspath(output)}")
Confidence
90% confidence
Finding
The code downloads from a URL returned by the remote API and includes the API key in the request headers to that URL. If the service or an upstream response is compromised and returns an attacker-controlled URL, the client will send the secret to that host, causing credential leakage and arbitrary outbound requests.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares only exec/read/write tools, but its documented behavior clearly depends on external network access and an API key from the environment. This mismatch weakens transparency and reviewability, making it easier for a skill to exfiltrate user-provided audio/text to a remote service without the permission model clearly signaling that risk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill's declared purpose focuses on voice cloning and TTS, but it also supports deletion of existing voice models. Undisclosed destructive functionality increases the chance of unsafe invocation, because users or agents may enable the skill expecting only creation/synthesis behavior while it can also remove assets remotely.

Description-Behavior Mismatch

Low
Confidence
84% confidence
Finding
The manifest description omits the deletion capability even though the documentation exposes it. This is primarily a transparency and least-surprise issue, but it matters because hidden destructive actions reduce informed consent and can lead to accidental or unauthorized asset deletion.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill implements deletion of existing voice models but the manifest/description does not disclose this destructive capability. Hidden destructive actions increase the risk of accidental or unauthorized data loss because users and orchestrators may grant or invoke the skill without understanding its full effects.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to upload reference audio and submit text to an external enterprise API without warning about third-party data transfer or privacy implications. Because voice samples and text may contain biometric or sensitive content, lack of disclosure can cause users to expose high-value personal data unintentionally.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The delete command is documented as a normal operation without any warning that it permanently removes existing voice models. In an agent-driven context, absence of a destructive-action warning increases the risk of accidental data loss, especially if a user misunderstands the command or an automated workflow invokes it incorrectly.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The upload path reads a local audio file and transmits its full contents to a remote third-party API without an explicit user-facing warning at the point of use. Because voice samples are sensitive biometric and personal data, silent transfer to an external service creates privacy, compliance, and consent risks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The TTS function sends user-provided text to an external API without explicitly warning that the content leaves the local system. This is risky when users may provide confidential, regulated, or proprietary text under the assumption that processing is local.

Static analysis

No suspicious patterns detected.