Edge Tts Unlimited

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:15 PM UTC
• Version: 1.0.1

Overview

This text-to-speech skill does what it advertises, but it automatically runs an unpinned external Python package and may silently install it into the active environment.

Review before installing. Use this only if you are comfortable sending the text you synthesize to the Edge TTS service, and prefer installing a reviewed, pinned edge-tts version in an isolated environment instead of allowing the script to fetch the latest package automatically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/speak.sh:42

Finding

Unpinned Third-Party Dependency Downloaded and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/speak.sh, lines 42–49
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

bash

run_edge_tts() {
  if [[ -n "$UV" ]]; then
    "$UV" run --with edge-tts -- edge-tts "$@"
  elif command -v edge-tts &>/dev/null; then
    edge-tts "$@"
  elif command -v pip3 &>/dev/null; then
    pip3 install -q edge-tts &>/dev/null
    edge-tts "$@"
  else

Technical Analysis

The script obtains and executes edge-tts using only an unversioned package name. Neither installation path specifies an exact reviewed version, verifies package hashes, uses a lockfile, or configures an explicit trusted package source. The effective code executed by the skill can therefore change after the skill itself has been audited.

The uv path dynamically resolves the package through uv run --with edge-tts. The pip3 fallback silently installs the package into the active Python environment and then executes its command. This fallback does not create a dedicated virtual environment, potentially modifying shared or user-level dependencies.

The issue does not prove that the current edge-tts package is malicious. The vulnerability is the unsafe runtime trust model: compromise of the package, one of its transitive dependencies, or the configured package index could turn an ordinary TTS invocation into arbitrary code execution.

Attack Path

1. An attacker compromises an applicable package release, transitive dependency, or configured Python package source.
2. A user invokes scripts/speak.sh on a system where edge-tts is not already installed as an executable.
3. The script resolves the latest available dependency through uv, or silently installs it through pip3.
4. Package-controlled installation or runtime code executes with the privileges of the user running the skill.
5. The malicious dependency accesses or modifies resources available to that user ...[truncated 658 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin edge-tts to an exact, reviewed version rather than resolving the latest release at runtime.
2. Lock the complete transitive dependency graph and require cryptographic package hashes.
3. Install dependencies during an explicit setup or build phase instead of silently downloading them during normal skill execution.
4. Use a dedicated virtual environment or another isolated runtime rather than installing into the active Python environment.
5. Configure an explicit trusted package index and prevent fallback to unapproved sources.
6. Fail with clear setup instructions when the verified dependency is unavailable, rather than automatically installing mutable remote code.
7. Periodically review pinned dependencies and update them through a controlled testing and approval process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script makes undisclosed network-dependent actions in two ways: it may install a package from package infrastructure and it sends text to Microsoft's Edge TTS service when generating audio. In an agent skill context, hidden outbound network use can expose sensitive user-provided text and violate operator expectations around offline execution, data handling, and change control.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script installs the edge-tts Python package at runtime with pip3 if it is not already present, which expands its behavior from simple TTS generation into software installation and remote code retrieval. This is risky because package installation depends on network access and trust in external package sources, and it occurs implicitly without explicit user consent or version pinning.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script defaults to en-US-GuyNeural, which imposes a specific language/locale choice unless the user overrides it manually. There is no documented opt-in or interactive language selection, so the default behavior forces a locale-specific output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.