ClawHub
Back to skill

Security audit

Fully offline Qwen3 TTS for your agent

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real text-to-speech skill, but its installer and unauthenticated messaging features create review-worthy security risks.

Install only after reviewing or pinning the repository contents. Prefer a verified release or fixed commit instead of the one-line curl-to-bash setup. Keep the server bound to 127.0.0.1 unless authentication is added, avoid storing messaging tokens in plaintext config when possible, and only clone voices you own or have permission to use. Treat Telegram/WhatsApp sends as external disclosure of the audio and destination metadata.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:34
Finding
Mutable Remote Installer Is Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `README.md:15`, `SKILL.md:34-40`, `install.sh:1-4` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Complete Code Snippet From `README.md:15`: ```bash bash <(curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh) ``` From `SKILL.md:34-40`: ```markdown ## First-Time Setup If the skill is not yet installed (no `~/clawd/skills/qwen3-tts` directory), run: ```bash bash <(curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh) ``` ``` From `install.sh:1-4`: ```bash #!/usr/bin/env bash # install.sh — One-command installer for the Qwen3-TTS OpenClaw skill # Usage: bash install.sh # or: curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh | bash ``` ### Technical Analysis The installation instructions retrieve a shell script from the mutable `main` branch of a personal GitHub repository and execute it immediately. There is no immutable commit reference, checksum, digital signature, local review step, or provenance verification. The payload that users or agents execute may therefore differ from the code audited in this project. A compromise of the repository, maintainer account, GitHub delivery path, or upstream branch can convert the installation command into arbitrary shell execution. This remote execution mechanism is not necessary for the declared TTS functionality. A bundled and reviewed installer, or a verified release artifact, can provide the same functionality with substantially less supply-chain risk. ### Attack Path 1. An attacker compromises the upstream repository or maintainer account, or otherwise gains permission to modify `main`. 2. The attacker replaces `install.sh` with a malicious payload. 3. A user or agent follows the documented first-time setup command. 4. `curl` retrieves the current malicious script. 5. Bash executes it immediately ...[truncated 672 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash` and process-substitution installation instructions. 2. Distribute the installer inside the reviewed Skill package. 3. If a remote artifact is unavoidable: - Reference an immutable commit or versioned release. - Download the file without executing it. - Verify a published SHA-256 checksum or cryptographic signature. - Display the resolved version and request explicit user approval. - Execute only the verified local copy. 4. Publish signed releases and document the expected signer identity. 5. Run installation with ordinary user privileges and explicitly warn users not to use `sudo`. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:83
Finding
Installer Executes an Unpinned Repository Checkout<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:22`, `install.sh:83-110` **Vulnerability Type**: Unpinned remote code execution during installation **Risk Level**: High ### Complete Code Snippet ```bash REPO_URL="https://github.com/daMustermann/claw-qwen3-tts.git" ``` ```bash # ─── Step 3: Clone or update the repo ─── if [ -d "$INSTALL_DIR" ]; then if [ -d "$INSTALL_DIR/.git" ]; then info "Skill already installed, updating..." cd "$INSTALL_DIR" git pull --ff-only origin main 2>/dev/null || { warn "Git pull failed, continuing with existing version" } ok "Updated to latest version" else warn "Directory $INSTALL_DIR exists but is not a git repo" warn "Skipping clone — using existing files" fi else info "Cloning skill from GitHub..." git clone "$REPO_URL" "$INSTALL_DIR" ok "Cloned to $INSTALL_DIR" fi cd "$INSTALL_DIR" # ─── Step 4: Make scripts executable ─── info "Setting script permissions..." chmod +x scripts/*.sh 2>/dev/null || true ok "Scripts are executable" # ─── Step 5: Run environment setup ─── info "Running environment setup (GPU detection, venv, dependencies)..." echo "" bash "$INSTALL_DIR/scripts/setup_env.sh" ``` ### Technical Analysis The installer clones the repository's default branch or updates from `origin main`, then immediately executes `scripts/setup_env.sh` from the resulting checkout. Neither the repository commit nor the setup script is verified. Consequently, even if the top-level installer is pinned or reviewed, it acts as a bootstrap loader for another mutable script. Automatic updates also replace previously installed code before execution, making the effective installation behavior dependent on the current upstream state. ### Attack Path 1. An attacker inserts malicious code into the upstream `main` branch, particularly `scripts/setup_env.sh`. 2. A new installation clones the changed default branch, or an existing inst ...[truncated 648 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the repository to a specific audited commit hash. 2. Clone without execution, verify the checked-out commit, and only then run setup. 3. Do not automatically pull and execute `main`. 4. Use signed tags or signed release archives and validate the signer. 5. Verify hashes for every executable installation script. 6. Separate update checks from updates and require explicit approval before replacing or executing code. 7. Prefer installing entirely from the already reviewed Skill artifact. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server/tts_server.py:666
Finding
Unauthenticated Messaging Endpoints Can Exfiltrate Arbitrary Readable Audio Files<![CDATA[ ## Vulnerability Details **File Location**: `server/tts_server.py:666-725`, `server/messaging/telegram_sender.py:49-75`, `server/messaging/whatsapp_sender.py:51-107` **Vulnerability Type**: Missing authorization and unrestricted local file path **Risk Level**: High ### Complete Code Snippet From the Telegram endpoint: ```python @app.post("/v1/audio/send/telegram") async def send_telegram(request: TelegramSendRequest): """Send audio as a Telegram PTT voice message.""" from messaging.telegram_sender import send_voice_message bot_token = request.bot_token or config.get("telegram", {}).get("bot_token", "") if not bot_token: raise HTTPException( status_code=400, detail="Telegram bot_token required (in request or config.json)", ) audio_path = os.path.expanduser(request.audio_file) if not os.path.exists(audio_path): raise HTTPException(status_code=404, detail=f"Audio file not found: {audio_path}") try: result = await send_voice_message( audio_path=audio_path, bot_token=bot_token, chat_id=request.chat_id, caption=request.caption, ) return {"status": "sent", "telegram_response": result} except Exception as e: raise HTTPException(status_code=500, detail=f"Telegram send failed: {e}") ``` From the WhatsApp endpoint: ```python @app.post("/v1/audio/send/whatsapp") async def send_whatsapp(request: WhatsAppSendRequest): """Send audio as a WhatsApp PTT voice message.""" from messaging.whatsapp_sender import send_voice_message phone_number_id = request.phone_number_id or config.get("whatsapp", {}).get("phone_number_id", "") access_token = request.access_token or config.get("whatsapp", {}).get("access_token", "") if not phone_number_id or not access_token: raise HTTPException( status_code=400, detail="WhatsApp phone_number_id and access_token required ( ...[truncated 3288 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Require strong authentication for all non-health API routes. 2. Enforce per-operation authorization, especially for messaging and voice CRUD endpoints. 3. Replace caller-supplied filesystem paths with opaque IDs for files generated by the service. 4. Resolve paths with `Path.resolve()` and enforce containment within a private output directory. 5. Reject symlinks and non-regular files. 6. Disable messaging integrations by default and expose them only when explicitly enabled. 7. Separate configured credentials from request bodies and apply strict destination allowlists where feasible. 8. Keep loopback binding as the default and refuse non-loopback binding unless authentication is configured. 9. Add audit logging that excludes tokens but records the authenticated principal, file ID, and destination. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
server/messaging/telegram_sender.py:57
Finding
Messaging Conversion Can Overwrite and Delete Adjacent Files<![CDATA[ ## Vulnerability Details **File Location**: `server/messaging/telegram_sender.py:57-80`, `server/messaging/whatsapp_sender.py:65-68,112-114`, `server/audio_converter.py:105-128` **Vulnerability Type**: Unsafe temporary output path and arbitrary file modification **Risk Level**: High ### Complete Code Snippet From the Telegram sender: ```python # Convert to OGG/Opus if needed ogg_path = audio_path if not audio_path.lower().endswith(".ogg"): ogg_path = str(Path(audio_path).with_suffix(".ogg")) convert_to_ogg_opus(audio_path, ogg_path) # Send via Telegram Bot API url = f"https://api.telegram.org/bot{bot_token}/sendVoice" async with httpx.AsyncClient(timeout=60) as client: with open(ogg_path, "rb") as f: data = {"chat_id": chat_id} if caption: data["caption"] = caption if duration: data["duration"] = str(duration) files = {"voice": (Path(ogg_path).name, f, "audio/ogg")} response = await client.post(url, data=data, files=files) # Clean up converted file if we created one if ogg_path != audio_path and os.path.exists(ogg_path): os.remove(ogg_path) ``` The converter enables unconditional overwrite: ```python if output_path is None: output_path = str(Path(input_path).with_suffix(".ogg")) cmd = [ "ffmpeg", "-y", "-i", input_path, "-c:a", "libopus", "-b:a", bitrate, "-vbr", "on", "-compression_level", "10", "-frame_duration", "20", "-application", "voip", output_path, ] try: result = subprocess.run( cmd, capture_output=True, text=True, timeout=120, ) ``` ### Technical Analysis For a non-OGG input, the output path is derived by replacing the input suffix with `.ogg`. The output is created in the same directory as the caller-selected input. FFmpeg receives `-y`, so an existing file at that path is overwritten without confirmation. After transmission, the sender deletes that output path. Becaus ...[truncated 1245 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Create conversion output with `tempfile.NamedTemporaryFile` or `mkstemp` in a private service-controlled directory. 2. Never derive a temporary output path beside caller-selected input. 3. Open temporary files with exclusive-creation semantics and restrictive permissions. 4. Track whether the service created the exact file before deleting it. 5. Restrict source files to the service output directory and use opaque file IDs. 6. Resolve paths and reject symlinks, devices, directories, and non-regular files. 7. Remove `-y` where accidental overwrite is possible, or guarantee that the destination is a newly allocated temporary path. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
server/tts_server.py:443
Finding
Unbounded Uploads and Unauthenticated Expensive Operations Enable Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `server/tts_server.py:443-506`, `server/tts_server.py:626-659` **Vulnerability Type**: Missing upload limits, rate limits, and workload controls **Risk Level**: Medium ### Complete Code Snippet From voice cloning: ```python @app.post("/v1/audio/voice-clone") async def clone_voice( input: str = Form(...), reference_audio: UploadFile = File(...), reference_text: str = Form(""), language: str = Form("en"), response_format: str = Form("wav"), ): """Clone a voice from reference audio and generate new speech.""" cloner = _get_voice_cloner() lang = normalize_language(language) output_path = _generate_output_path("vclone", "wav") # Save uploaded reference audio to temp file ref_suffix = Path(reference_audio.filename or "ref.wav").suffix or ".wav" fd, ref_path = tempfile.mkstemp(suffix=ref_suffix) try: with os.fdopen(fd, "wb") as f: content = await reference_audio.read() f.write(content) result = cloner.clone( text=input, reference_audio_path=ref_path, reference_text=reference_text, language=lang, output_path=output_path, ) ``` From audio conversion: ```python @app.post("/v1/audio/convert") async def convert_audio_format( audio: UploadFile = File(...), target_format: str = Form("ogg"), ): """Convert audio between formats (WAV, MP3, OGG/Opus, FLAC).""" in_suffix = Path(audio.filename or "input.wav").suffix or ".wav" fd, input_path = tempfile.mkstemp(suffix=in_suffix) try: with os.fdopen(fd, "wb") as f: content = await audio.read() f.write(content) output_path = _generate_output_path("converted", target_format) convert_audio(input_path, output_path, target_format) ``` ### Technical Analysis Both routes read the entire uploaded file into memory with `await UploadFile.read()` before w ...[truncated 1405 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Enforce maximum request and upload sizes at both the reverse proxy and application layers. 2. Stream uploads in bounded chunks rather than reading the full body into memory. 3. Reject audio exceeding configured byte-size and decoded-duration limits. 4. Limit text and voice-description lengths. 5. Require authentication and add per-principal rate limits. 6. Use bounded worker queues and strict inference concurrency limits. 7. Apply CPU, memory, GPU, execution-time, and disk quotas. 8. Add retention policies and periodic cleanup for generated output and unsaved voice references. 9. Return HTTP 413 for oversized content and HTTP 429 for exceeded quotas. ]]>

T08 · Insecure Dependencies

Warning
Location
requirements/base.txt:1
Finding
Dependencies and Model Snapshots Are Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements/base.txt:1-13`, `scripts/setup_env.sh:110-151`, `server/model_loader.py:36-48` **Vulnerability Type**: Mutable third-party dependency and model supply chain **Risk Level**: Medium ### Complete Code Snippet From `requirements/base.txt`: ```text qwen-tts fastapi>=0.115.0 uvicorn[standard]>=0.34.0 soundfile>=0.13.0 numpy scipy pydub python-multipart httpx aiofiles python-telegram-bot>=21.0 pydantic>=2.0 huggingface-hub[hf_xet] ``` From `scripts/setup_env.sh`: ```bash # shellcheck disable=SC1091 source "$VENV_DIR/bin/activate" pip install --upgrade pip setuptools wheel --quiet ok "pip/setuptools/wheel upgraded" ``` ```bash case "$gpu_type" in cuda) pip install torch torchaudio --index-url https://download.pytorch.org/whl/cu128 --quiet ;; rocm) pip install torch torchaudio --index-url https://download.pytorch.org/whl/rocm6.3 --quiet ;; intel) pip install torch torchaudio intel-extension-for-pytorch --index-url https://download.pytorch.org/whl/xpu --quiet ;; cpu) pip install torch torchaudio --index-url https://download.pytorch.org/whl/cpu --quiet ;; esac ``` ```bash pip install -r "$REQ_DIR/base.txt" --quiet ``` From `server/model_loader.py`: ```python def download_and_fix_model(model_id: str, cache_dir: Optional[str] = None) -> str: """ Download a Qwen3-TTS model and fix the speech_tokenizer directory structure. Returns the local path to the fixed model directory. """ from huggingface_hub import snapshot_download print(f"[INFO] Downloading model {model_id}...") kwargs = {} if cache_dir: kwargs["cache_dir"] = cache_dir local_dir = snapshot_download(model_id, **kwargs) ``` ### Technical Analysis Most Python packages have no exact version constraint, and several only specify a minimum version. The setup script also upgrades packaging tools and installs the latest co ...[truncated 1391 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every direct and transitive Python dependency to an exact reviewed version. 2. Generate a lock file with cryptographic hashes, for example using `pip-compile --generate-hashes`. 3. Install with hash enforcement and without opportunistically upgrading pip tooling. 4. Pin PyTorch, torchaudio, and accelerator packages to tested versions. 5. Pin Hugging Face downloads using immutable repository commit hashes through the `revision` parameter. 6. Record and verify expected model artifact hashes where practical. 7. Use trusted package indexes explicitly and prevent dependency fallback to unexpected sources. 8. Add automated dependency vulnerability scanning and a controlled update-review process. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (82)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The code chunk only implements audio format conversion to OGG/Opus for messaging platforms. While that supports one small part of the declared delivery pipeline (native voice-message-compatible audio), it does not perform the core advertised functionality of TTS generation or any of the advanced voice features. The primary purpose of the code is materially narrower and different from the declared description, so this is a clear mismatch.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description centers on a full-featured TTS system, but the supplied code does not synthesize speech at all. It only converts existing audio files and inspects audio metadata using ffmpeg/ffprobe. One small part of the description—delivering audio in Telegram/WhatsApp-friendly OGG/Opus format—is partially aligned with the helper function `convert_to_ogg_opus`, but this is only a supporting audio conversion utility, not evidence of the broader TTS capabilities claimed. Therefore the code chunk's actual behavior is materially different from the declared primary purpose.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The declared description presents a complete end-user TTS skill with multiple advanced voice features and messaging-platform delivery. The supplied code chunk is much narrower: it is an internal model loader/downloader for Qwen3-TTS. It does support part of the hardware auto-selection claim by choosing CUDA, XPU, or CPU and selecting an attention backend, but it does not implement the core user-facing capabilities described. Because the actual code's primary purpose is model acquisition/fixing/loading rather than TTS synthesis and delivery, the description materially overstates what this code chunk does.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The code largely matches the declared purpose: it provides Qwen3-TTS speech generation, built-in speakers with instruct control, voice cloning, natural-language voice design, persistent voice management, multilingual language mapping, and Telegram/WhatsApp delivery. However, there are two notable description/behavior mismatches. First, the code exposes a standalone audio conversion API (/v1/audio/convert) for converting uploaded audio between formats, which is an undeclared capability beyond simple support functionality for TTS output delivery. Second, the description claims auto-detection of CUDA, ROCm, Intel XPU, and CPU, but the code only explicitly detects torch.cuda, torch.xpu, and CPU; there is no explicit ROCm branch. While ROCm may sometimes surface via torch.cuda in some environments, that behavior is not represented directly in the code. Therefore the description is not fully accurate.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The supplied code chunk is narrowly focused on voice cloning, not the full declared skill behavior. It supports cloning from reference audio, reusable prompts, multilingual generation via a language parameter, and device auto-selection for CUDA/XPU/CPU. However, it does not implement several major declared features: built-in speakers, emotional control, natural-language voice design, persistent named voices, or Telegram/WhatsApp message delivery. The generated output is simply written to a local WAV file. Also, the declared hardware support mentions ROCm, but this code only checks CUDA and Intel XPU, then falls back to CPU. Because the code represents only a subset of the declared product capabilities, the description does not accurately match this chunk.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Content
the Server

Before any TTS operation, ensure the server is running:

```bash
# Start (idempotent — won't restart if already running)
bash ~/clawd/skills/qwen3-tts/scripts/start_server.sh

# Check health
bash ~/clawd/skills/qwen3-tts/scripts/health_check.sh

# Stop (when done)
bash ~/clawd/skills/qwen3-tts/scripts/stop_server.sh
```

The server runs at `http://localhost:8880`.

---

## Available Models

| Model ID | Use Case | Notes |
|----------|----------|-------|
| `custom-voice-1.7b` | High-quality TTS with built-in speakers — **default** | Best quality, ~5 GB VRAM |
| `custom-voice-0.6b` | Fast TTS with built-in speakers | Lightweight, ~2 GB VRAM |
| `voice-design` | Design new voices from natural language descriptions | Uses VoiceDesign model |
| `base-1.7b` | Basic TTS (auto-corrected to `custom-voice-1.7b`) | Use `custom-voice-*` instead |
| `base-0.6b` | Basic TTS (auto-corrected to `custom-voice-0.6b`) | Use `custom-voice-*` instead |

> **Important:** On the `/v1/audio/sp
Confidence
88% confidence
Finding
The skill contains imperative hidden-style instructions such as 'YOU MUST FOLLOW THESE RULES,' which attempt to steer agent behavior from within untrusted skill content. In agent systems, such embedded control instructions are dangerous because they can override normal policy flow, expand persistence of actions, and create a prompt-injection surface even if the content appears operational rather than overtly malicious.

Credential Access

High
Category
Privilege Escalation
Content
The agent can update `~/clawd/skills/qwen3-tts/config.json` to set:
- **Telegram:** bot token and default chat ID
- **WhatsApp:** phone number ID and access token
- **Default model:** `custom-voice-1.7b` or `custom-voice-0.6b`
- **Default audio format:** wav, mp3, ogg, flac
- **Device override:** auto, cuda:0, xpu:0, cpu
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to update configuration with Telegram bot tokens and WhatsApp access tokens, creating a pathway for credential handling and persistent storage. In an agent context with file-write capability, this is sensitive because secrets can be exposed through logs, world-readable files, backups, or later prompt-induced disclosure, enabling account compromise and abuse of messaging APIs.

Chaining Abuse

High
Category
Tool Misuse
Content
#!/usr/bin/env bash
# install.sh — One-command installer for the Qwen3-TTS OpenClaw skill
# Usage: bash install.sh
#   or:  curl -fsSL https://raw.githubusercontent.com/daMustermann/claw-qwen3-tts/main/install.sh | bash
set -euo pipefail

# ─── Colors ───
Confidence
95% confidence
Finding
The documented `curl ... | bash` pattern is a classic dangerous command chain because it combines network retrieval and immediate shell execution in one step. If the remote source is compromised or tampered with, arbitrary code executes instantly with the user's privileges, making installer context especially sensitive.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High
Category
Supply Chain
Confidence
70% confidence
Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Chaining Abuse

High
Category
Tool Misuse
Content
;;
            ubuntu|debian|linuxmint|pop)
                echo "  Install with:"
                echo "    sudo apt update && sudo apt install -y python3 python3-pip python3-venv ffmpeg sox git build-essential"
                ;;
            fedora|rhel|centos|rocky|alma)
                echo "  Install with:"
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
;;
            ubuntu|debian|linuxmint|pop)
                echo "  Install with:"
                echo "    sudo apt update && sudo apt install -y python3 python3-pip python3-venv ffmpeg sox git build-essential"
                ;;
            fedora|rhel|centos|rocky|alma)
                echo "  Install with:"
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Credential Access

High
Category
Privilege Escalation
Content
audio_path: Path to the audio file
        phone_number_id: WhatsApp Business phone number ID
        recipient: Recipient phone number (E.164 format, e.g. "+14155551234")
        access_token: Meta Graph API access token

    Returns:
        dict with WhatsApp API response
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Transmission

Medium
Category
Data Exfiltration
Content
### Speech Generation

```bash
curl -X POST http://localhost:8880/v1/audio/speech \
  -H "Content-Type: application/json" \
  -d '{
    "model": "custom-voice-1.7b",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README promotes voice cloning from short reference audio but does not warn that cloning another person's voice may require their consent and can expose privacy, impersonation, and fraud risks. In an agent skill context, this omission can normalize unsafe use and lead operators to deploy voice cloning without authorization checks or policy guardrails.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README documents Telegram and WhatsApp delivery endpoints without clearly warning that generated audio, recipient identifiers, and API credentials are transmitted to third-party services. This can cause accidental leakage of sensitive content or secrets, especially when operators assume the skill is otherwise local because the API itself runs on localhost.

External Transmission

Medium
Category
Data Exfiltration
Content
Configure your bot token in `config.json`, then the agent sends audio as native PTT voice messages using `sendVoice` (OGG/Opus format).

```bash
curl -X POST http://localhost:8880/v1/audio/send/telegram \
  -H "Content-Type: application/json" \
  -d '{
    "audio_file": "/path/to/speech.wav",
Confidence
96% confidence
Finding
This example sends an audio file, chat identifier, and bot token through an endpoint intended to transmit data to Telegram, so it clearly involves third-party data transfer and secret handling. In an agent environment, poorly disclosed external messaging behavior can lead to unintentional disclosure of generated speech or credential exposure through logs, configs, or misuse.

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to use shell commands, local file reads/writes, and network operations, but it declares no explicit tool scope or permissions boundaries. In an agent environment, this increases the blast radius of prompt misuse or user-driven abuse because the runtime may permit broader actions than the manifest communicates.

External Transmission

Medium
Category
Data Exfiltration
Content
> **Chelsie** · **Ethan** · **Aidan** · **Serena** · **Ryan** · **Vivian** · **Claire** · **Lucas** · **Eleanor** · **Benjamin**

You can discover speakers dynamically: `curl http://localhost:8880/v1/speakers`

---
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**When to use:** User wants to create a custom voice, describe how a character should sound, design a persona's voice.

```bash
curl -X POST http://localhost:8880/v1/audio/voice-design \
  -H "Content-Type: application/json" \
  -d '{
    "model": "voice-design",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill promotes voice cloning from reference audio without any consent, identity-misuse, or privacy warning. In context, this is more dangerous because the core purpose is cloning human voices, which can enable impersonation, fraud, harassment, or unauthorized biometric-data processing if users or agents proceed without safeguards.

External Transmission

Medium
Category
Data Exfiltration
Content
2. **If the user says yes**, capture the `X-Voice-Id` from the response headers and save it:
   ```bash
   curl -X POST http://localhost:8880/v1/voices \
     -H "Content-Type: application/json" \
     -d '{
       "name": "USER_CHOSEN_NAME",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The Telegram and WhatsApp flows send audio content and possibly credentials to third-party services without an explicit warning that data leaves the local system. This is risky because users may unknowingly transmit sensitive audio, phone numbers, chat identifiers, or API tokens to external platforms.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The configuration guidance encourages storing Telegram and WhatsApp credentials in a local JSON file without any warning about secret-at-rest exposure. If filesystem permissions are weak, other local users, malware, backups, or logs could disclose bot tokens and access tokens, enabling account abuse and unauthorized messaging.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The installer unconditionally executes a secondary script from the cloned repository (`scripts/setup_env.sh`) with no confirmation, review step, or trust verification. Because that script can perform arbitrary local and network actions, users who run the one-command installer may trigger significant system changes without an informed consent boundary.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
torchaudio

# Optional: flash-attn for faster inference (requires CUDA toolkit / nvcc)
# Install CUDA toolkit first: sudo pacman -S cuda  (CachyOS/Arch)
# Then: CUDA_HOME=/opt/cuda pip install flash-attn --no-build-isolation
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.