ClawHub
Back to skill

Security audit

Bailian TTS

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Alibaba Bailian/DashScope text-to-speech helper with normal cloud API risks and some hardening gaps, but no hidden or destructive behavior.

Install in an isolated environment, pin dependency versions where possible, protect the DashScope API key, avoid submitting secrets or regulated personal data to the cloud TTS service, and treat output paths carefully because the script writes the downloaded audio to the path you choose.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:138
Finding

Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tts.py:89
Finding

Unvalidated API-Provided Audio Download URL

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tainted flow: 'audio_url' from os.getenv (line 90, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

The script blindly trusts an audio URL returned by an external API and fetches it with requests.get without validating the scheme, host, or destination. If the upstream service is compromised or returns attacker-controlled URLs, this can enable server-side request forgery behavior or unintended network access from the host running the skill, and the fetched content is then written directly to a user-chosen file path.

Content

Scanner excerpt · scripts/tts.py (reported line 93)May include surrounding context.

python
audio_url = output['audio']['url']
                    
                    # 下载音频
                    audio_response = requests.get(audio_url, timeout=60)
                    if audio_response.status_code == 200:
                        with open(output_file, "wb") as f:
                            f.write(audio_response.content)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documents a cloud-based TTS service and even mentions API key configuration, but it does not clearly warn users that submitted text and, for voice-cloning features, optional audio samples may be sent to a third-party provider. This can lead users to unknowingly transmit sensitive or regulated data off-platform, creating privacy, compliance, and data-handling risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code file contains user-facing natural-language descriptions and CLI help text that assume Chinese as the only interaction language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.