Security audit

Fully offline Qwen3 TTS for your agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real text-to-speech skill, but its installer and unauthenticated messaging features create review-worthy security risks.

Install only after reviewing or pinning the repository contents. Prefer a verified release or fixed commit instead of the one-line curl-to-bash setup. Keep the server bound to 127.0.0.1 unless authentication is added, avoid storing messaging tokens in plaintext config when possible, and only clone voices you own or have permission to use. Treat Telegram/WhatsApp sends as external disclosure of the audio and destination metadata.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:34
Finding: Mutable Remote Installer Is Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:83
Finding: Installer Executes an Unpinned Repository Checkout
Content: View full analysis
/dev/null || { warn "Git pull failed, continuing with existing version" } ok "Updated to latest version" else warn "Directory $INSTALL_DIR exists but is not a git repo" warn "Skipping clone — using existing files" fi else info "Cloning skill from GitHub..." git clone "$REPO_URL" "$INSTALL_DIR" ok "Cloned to $INSTALL_DIR" fi cd "$INSTALL_DIR" # ─── Step 4: Make scripts executable ─── info "Setting script permissions..." chmod +x scripts/*.sh 2>/dev/null || true ok "Scripts are executable" # ─── Step 5: Run environment setup ─── info "Running environment setup (GPU detection, venv, dependencies)..." echo "" bash "$INSTALL_DIR/scripts/setup_env.sh" ``` ### Technical Analysis The installer clones the repository's default branch or updates from `origin main`, then immediately executes `scripts/setup_env.sh` from the resulting checkout. Neither the repository commit nor the setup script is verified. Consequently, even if the top-level installer is pinned or reviewed, it acts as a bootstrap loader for another mutable script. Automatic updates also replace previously installed code before execution, making the effective installation behavior dependent on the current upstream state. ### Attack Path 1. An attacker inserts malicious code into the upstream `main` branch, particularly `scripts/setup_env.sh`. 2. A new installation clones the changed default branch, or an existing inst ...[truncated 648 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server/tts_server.py:666
Finding: Unauthenticated Messaging Endpoints Can Exfiltrate Arbitrary Readable Audio Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: server/messaging/telegram_sender.py:57
Finding: Messaging Conversion Can Overwrite and Delete Adjacent Files
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server/tts_server.py:443
Finding: Unbounded Uploads and Unauthenticated Expensive Operations Enable Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements/base.txt:1
Finding: Dependencies and Model Snapshots Are Not Reproducibly Pinned
Content: View full analysis
=0.115.0 uvicorn[standard]>=0.34.0 soundfile>=0.13.0 numpy scipy pydub python-multipart httpx aiofiles python-telegram-bot>=21.0 pydantic>=2.0 huggingface-hub[hf_xet] ``` From `scripts/setup_env.sh`: ```bash # shellcheck disable=SC1091 source "$VENV_DIR/bin/activate" pip install --upgrade pip setuptools wheel --quiet ok "pip/setuptools/wheel upgraded" ``` ```bash case "$gpu_type" in cuda) pip install torch torchaudio --index-url https://download.pytorch.org/whl/cu128 --quiet ;; rocm) pip install torch torchaudio --index-url https://download.pytorch.org/whl/rocm6.3 --quiet ;; intel) pip install torch torchaudio intel-extension-for-pytorch --index-url https://download.pytorch.org/whl/xpu --quiet ;; cpu) pip install torch torchaudio --index-url https://download.pytorch.org/whl/cpu --quiet ;; esac ``` ```bash pip install -r "$REQ_DIR/base.txt" --quiet ``` From `server/model_loader.py`: ```python def download_and_fix_model(model_id: str, cache_dir: Optional[str] = None) -> str: """ Download a Qwen3-TTS model and fix the speech_tokenizer directory structure. Returns the local path to the fixed model directory. """ from huggingface_hub import snapshot_download print(f"[INFO] Downloading model {model_id}...") kwargs = {} if cache_dir: kwargs["cache_dir"] = cache_dir local_dir = snapshot_download(model_id, **kwargs) ``` ### Technical Analysis Most Python packages have no exact version constraint, and several only specify a minimum version. The setup script also upgrades packaging tools and installs the latest co ...[truncated 1391 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (82)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk only implements audio format conversion to OGG/Opus for messaging platforms. While that supports one small part of the declared delivery pipeline (native voice-message-compatible audio), it does not perform the core advertised functionality of TTS generation or any of the advanced voice features. The primary purpose of the code is materially narrower and different from the declared description, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on a full-featured TTS system, but the supplied code does not synthesize speech at all. It only converts existing audio files and inspects audio metadata using ffmpeg/ffprobe. One small part of the description—delivering audio in Telegram/WhatsApp-friendly OGG/Opus format—is partially aligned with the helper function convert_to_ogg_opus, but this is only a supporting audio conversion utility, not evidence of the broader TTS capabilities claimed. Therefore the code chunk's actual behavior is materially different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a complete end-user TTS skill with multiple advanced voice features and messaging-platform delivery. The supplied code chunk is much narrower: it is an internal model loader/downloader for Qwen3-TTS. It does support part of the hardware auto-selection claim by choosing CUDA, XPU, or CPU and selecting an attention backend, but it does not implement the core user-facing capabilities described. Because the actual code's primary purpose is model acquisition/fixing/loading rather than TTS synthesis and delivery, the description materially overstates what this code chunk does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code largely matches the declared purpose: it provides Qwen3-TTS speech generation, built-in speakers with instruct control, voice cloning, natural-language voice design, persistent voice management, multilingual language mapping, and Telegram/WhatsApp delivery. However, there are two notable description/behavior mismatches. First, the code exposes a standalone audio conversion API (/v1/audio/convert) for converting uploaded audio between formats, which is an undeclared capability beyond simple support functionality for TTS output delivery. Second, the description claims auto-detection of CUDA, ROCm, Intel XPU, and CPU, but the code only explicitly detects torch.cuda, torch.xpu, and CPU; there is no explicit ROCm branch. While ROCm may sometimes surface via torch.cuda in some environments, that behavior is not represented directly in the code. Therefore the description is not fully accurate.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied code chunk is narrowly focused on voice cloning, not the full declared skill behavior. It supports cloning from reference audio, reusable prompts, multilingual generation via a language parameter, and device auto-selection for CUDA/XPU/CPU. However, it does not implement several major declared features: built-in speakers, emotional control, natural-language voice design, persistent named voices, or Telegram/WhatsApp message delivery. The generated output is simply written to a local WAV file. Also, the declared hardware support mentions ROCm, but this code only checks CUDA and Intel XPU, then falls back to CPU. Because the code represents only a subset of the declared product capabilities, the description does not accurately match this chunk.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

Category: YARA Match
Confidence: 88% confidence
Finding: The skill contains imperative hidden-style instructions such as 'YOU MUST FOLLOW THESE RULES,' which attempt to steer agent behavior from within untrusted skill content. In agent systems, such embedded control instructions are dangerous because they can override normal policy flow, expand persistence of actions, and create a prompt-injection surface even if the content appears operational rather than overtly malicious.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
the Server

Before any TTS operation, ensure the server is running:

bash
# Start (idempotent — won't restart if already running) bash ~/clawd/skills/qwen3-tts/scripts/start_server.sh # Check health bash ~/clawd/skills/qwen3-tts/scripts/health_check.sh # Stop (when done) bash ~/clawd/skills/qwen3-tts/scripts/stop_server.sh

The server runs at http://localhost:8880.

Available Models

Model ID Use Case Notes
custom-voice-1.7b High-quality TTS with built-in speakers — default Best quality, ~5 GB VRAM
custom-voice-0.6b Fast TTS with built-in speakers Lightweight, ~2 GB VRAM
voice-design Design new voices from natural language descriptions Uses VoiceDesign model
base-1.7b Basic TTS (auto-corrected to custom-voice-1.7b) Use custom-voice-* instead
base-0.6b Basic TTS (auto-corrected to custom-voice-0.6b) Use custom-voice-* instead

Important: On the `/v1/audio/sp

Model ID	Use Case	Notes
`custom-voice-1.7b`	High-quality TTS with built-in speakers — default	Best quality, ~5 GB VRAM
`custom-voice-0.6b`	Fast TTS with built-in speakers	Lightweight, ~2 GB VRAM
`voice-design`	Design new voices from natural language descriptions	Uses VoiceDesign model
`base-1.7b`	Basic TTS (auto-corrected to `custom-voice-1.7b`)	Use `custom-voice-*` instead
`base-0.6b`	Basic TTS (auto-corrected to `custom-voice-0.6b`)	Use `custom-voice-*` instead

Credential Access

High

Category: Privilege Escalation
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to update configuration with Telegram bot tokens and WhatsApp access tokens, creating a pathway for credential handling and persistent storage. In an agent context with file-write capability, this is sensitive because secrets can be exposed through logs, world-readable files, backups, or later prompt-induced disclosure, enabling account compromise and abuse of messaging APIs.
Content: Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.
md
The agent can update `~/clawd/skills/qwen3-tts/config.json` to set: - **Telegram:** bot token and default chat ID - **WhatsApp:** phone number ID and access token - **Default model:** `custom-voice-1.7b` or `custom-voice-0.6b` - **Default audio format:** wav, mp3, ogg, flac - **Device override:** auto, cuda:0, xpu:0, cpu

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The documented curl ... | bash pattern is a classic dangerous command chain because it combines network retrieval and immediate shell execution in one step. If the remote source is compromised or tampered with, arbitrary code executes instantly with the user's privileges, making installer context especially sensitive.
Content: Scanner excerpt · install.sh (reported line 4)May include surrounding context.
sh
#!/usr/bin/env bash # install.sh — One-command installer for the Qwen3-TTS OpenClaw skill # Usage: bash install.sh # or: curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh | bash set -euo pipefail # ─── Colors ───

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · install.sh (reported line 55)May include surrounding context.
sh
;; ubuntu|debian|linuxmint|pop) echo " Install with:" echo " sudo apt update && sudo apt install -y python3 python3-pip python3-venv ffmpeg sox git build-essential" ;; fedora|rhel|centos|rocky|alma) echo " Install with:"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · scripts/setup_env.sh (reported line 54)May include surrounding context.
sh
;; ubuntu|debian|linuxmint|pop) echo " Install with:" echo " sudo apt update && sudo apt install -y python3 python3-pip python3-venv ffmpeg sox git build-essential" ;; fedora|rhel|centos|rocky|alma) echo " Install with:"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · server/messaging/whatsapp_sender.py (reported line 42)May include surrounding context.
python
audio_path: Path to the audio file phone_number_id: WhatsApp Business phone number ID recipient: Recipient phone number (E.164 format, e.g. "+14155551234") access_token: Meta Graph API access token Returns: dict with WhatsApp API response

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 81)May include surrounding context.
Speech Generation

bash
curl -X POST http://localhost:8880/v1/audio/speech \ -H "Content-Type: application/json" \ -d '{ "model": "custom-voice-1.7b",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README promotes voice cloning from short reference audio but does not warn that cloning another person's voice may require their consent and can expose privacy, impersonation, and fraud risks. In an agent skill context, this omission can normalize unsafe use and lead operators to deploy voice cloning without authorization checks or policy guardrails.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README documents Telegram and WhatsApp delivery endpoints without clearly warning that generated audio, recipient identifiers, and API credentials are transmitted to third-party services. This can cause accidental leakage of sensitive content or secrets, especially when operators assume the skill is otherwise local because the API itself runs on localhost.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This example sends an audio file, chat identifier, and bot token through an endpoint intended to transmit data to Telegram, so it clearly involves third-party data transfer and secret handling. In an agent environment, poorly disclosed external messaging behavior can lead to unintentional disclosure of generated speech or credential exposure through logs, configs, or misuse.
Content: Scanner excerpt · README.md (reported line 183)May include surrounding context.
Configure your bot token in config.json, then the agent sends audio as native PTT voice messages using sendVoice (OGG/Opus format).

bash
curl -X POST http://localhost:8880/v1/audio/send/telegram \ -H "Content-Type: application/json" \ -d '{ "audio_file": "/path/to/speech.wav",

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to use shell commands, local file reads/writes, and network operations, but it declares no explicit tool scope or permissions boundaries. In an agent environment, this increases the blast radius of prompt misuse or user-driven abuse because the runtime may permit broader actions than the manifest communicates.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
> **Chelsie** · **Ethan** · **Aidan** · **Serena** · **Ryan** · **Vivian** · **Claire** · **Lucas** · **Eleanor** · **Benjamin** You can discover speakers dynamically: `curl http://localhost:8880/v1/speakers` ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
When to use: User wants to create a custom voice, describe how a character should sound, design a persona's voice.

bash
curl -X POST http://localhost:8880/v1/audio/voice-design \ -H "Content-Type: application/json" \ -d '{ "model": "voice-design",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill promotes voice cloning from reference audio without any consent, identity-misuse, or privacy warning. In context, this is more dangerous because the core purpose is cloning human voices, which can enable impersonation, fraud, harassment, or unauthorized biometric-data processing if users or agents proceed without safeguards.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

If the user says yes, capture the X-Voice-Id from the response headers and save it:
bash
curl -X POST http://localhost:8880/v1/voices \ -H "Content-Type: application/json" \ -d '{ "name": "USER_CHOSEN_NAME",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Telegram and WhatsApp flows send audio content and possibly credentials to third-party services without an explicit warning that data leaves the local system. This is risky because users may unknowingly transmit sensitive audio, phone numbers, chat identifiers, or API tokens to external platforms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The configuration guidance encourages storing Telegram and WhatsApp credentials in a local JSON file without any warning about secret-at-rest exposure. If filesystem permissions are weak, other local users, malware, backups, or logs could disclose bot tokens and access tokens, enabling account abuse and unauthorized messaging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer unconditionally executes a secondary script from the cloned repository (scripts/setup_env.sh) with no confirmation, review step, or trust verification. Because that script can perform arbitrary local and network actions, users who run the one-command installer may trigger significant system changes without an informed consent boundary.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install.sh (reported line 52)May include surrounding context.
sh
torchaudio # Optional: flash-attn for faster inference (requires CUDA toolkit / nvcc) # Install CUDA toolkit first: sudo pacman -S cuda (CachyOS/Arch) # Then: CUDA_HOME=/opt/cuda pip install flash-attn --no-build-isolation

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

Available Models

Credential Access

Chaining Abuse

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

Chaining Abuse

Chaining Abuse

Credential Access

External Transmission

Speech Generation

Missing User Warnings

Missing User Warnings

External Transmission

Undeclared Tool Scope

External Transmission

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

Sudo/Root Execution