ClawHub
Back to skill

Security audit

free-tts

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its cloud TTS and voice-cloning purpose, but it handles API keys and voice recordings with persistent storage and disclosure gaps that warrant user review before installation.

Review before installing if you are comfortable sending text and voice recordings to Fish Audio or Xiaomi MiMo. Do not upload third-party or sensitive voices unless you have consent and understand provider retention/model-improvement terms. Be aware that API keys are stored persistently in Windows user environment variables, authenticated proxy URLs may be printed by setup.py check, and voices_cache.json may retain local recording paths after cloning.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup.py:54
Finding

Proxy credentials may be disclosed through console output

Content
View full analysis
Remediation
View remediation
str: if not value: return "(not configured)" try: parsed = urlsplit(value) host = parsed.hostname or "" port = f":{parsed.port}" if parsed.port else "" return urlunsplit((parsed.scheme, host + port, "", "", "")) except (TypeError, ValueError): return "(configured; value hidden)" proxy = ( os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy") or os.environ.get("HTTP_PROXY") ) print(f"Proxy: {mask_proxy(proxy)}") ``` ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/fish_clone.py:176
Finding

Absolute paths to biometric voice recordings are unnecessarily persisted

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

Tainted flow: 'req' from os.environ.get (line 154, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/setup.py (reported line 140)May include surrounding context.

python
data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=headers, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return resp.status, resp.read(), dict(resp.headers)
    except urllib.error.HTTPError as e:
        return e.code, e.read(), {}

Tainted flow: 'req' from os.environ.get (line 154, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/setup.py (reported line 160)May include surrounding context.

python
method="GET",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            body = resp.read().decode("utf-8", errors="replace")
            print(f"✅ Fish API 连通 (HTTP {resp.status})，key 有效。")
            try:

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a TTS/voice-cloning utility but also instructs persistent storage of API credentials in Windows user environment/registry and performs external key validation. Hiding platform-specific credential persistence behind a content-generation description is dangerous because it affects long-term secret exposure and system configuration beyond the user's likely expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill presents itself as a TTS/voice-cloning utility but also instructs persistent storage of API credentials in Windows user environment/registry and performs external key validation. Hiding platform-specific credential persistence behind a content-generation description is dangerous because it affects long-term secret exposure and system configuration beyond the user's likely expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill presents itself as a TTS/voice-cloning utility but also instructs persistent storage of API credentials in Windows user environment/registry and performs external key validation. Hiding platform-specific credential persistence behind a content-generation description is dangerous because it affects long-term secret exposure and system configuration beyond the user's likely expectations.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill presents itself as a TTS/voice-cloning utility but also instructs persistent storage of API credentials in Windows user environment/registry and performs external key validation. Hiding platform-specific credential persistence behind a content-generation description is dangerous because it affects long-term secret exposure and system configuration beyond the user's likely expectations.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/fish-api.md (reported line 87)May include surrounding context.

Endpoint 4：删除模型

text
DELETE /model/{voice_id}

200/204 成功。

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill advertises and instructs use of capabilities that include network access, reading/writing files, and persisting API keys in user environment variables, but it does not declare an explicit tool scope or permission boundary. That creates an authorization and review gap: a consumer may invoke a skill with broader effective powers than are visible from the manifest, increasing the chance of unintended credential handling or external calls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Overly broad trigger phrases increase the likelihood of accidental invocation when a user casually mentions speech, voice, or related topics. In this skill's context, accidental invocation is more risky than usual because the workflow can lead to credential setup, network calls, and handling of sensitive voice samples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L28 指示 ‘把下面的指引原样给用户’，而后续 L30-L38 全为中文固定文案，意味着在特定场景下输出语言被预设为中文。文件中未说明应根据用户语言偏好切换，也未提供显式的语言选择或 opt-in。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document explicitly promotes voice cloning and states that request data may be used for model improvement, but it does not provide a clear warning that users may be uploading biometric voice data and transcripts to a third-party service. In a TTS/voice-cloning skill, this omission is security- and privacy-relevant because users may unknowingly transmit sensitive personal data, including persistent voice identifiers and reusable cloned voice models.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all CLI help/output strings are written in Chinese, which imposes a specific language on users of the skill. The file does not provide any opt-in, locale selection, or justification that this is a region-specific tool, so it violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring, CLI description, help text, and runtime messages are presented only in Chinese, with no option to select another language. This is a natural-language policy concern because it forces a locale/language on all users rather than offering opt-in or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The script sends user-provided text, optional style/instructions, and in clone mode the user's reference voice audio to an external third-party API endpoint. In this skill's context, that data can be highly sensitive biometrics and personal content, so external transmission introduces privacy, data handling, and consent risk even though it is necessary for the service to function.

Content

Scanner excerpt · scripts/mimo_tts.py (reported line 36)May include surrounding context.

python
except Exception:
        pass

BASE_URL = "https://api.xiaomimimo.com/v1"
VOICES_CN = ["冰糖", "茉莉", "苏打", "白桦"]
VOICES_EN = ["Mia", "Chloe", "Milo", "Dean"]
ALL_VOICES = VOICES_CN + VOICES_EN

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fish-api.md (reported line 98)May include surrounding context.

md
FISH_KEY_URL = "https://fish.audio/app/api-keys/"
MIMO_KEY_URL = "https://platform.xiaomimimo.com/#/console/api-keys"
MIMO_REGISTER_URL = "https://id.mi.com/"
FISH_TTS_ENDPOINT = "https://api.fish.audio/v1/tts"
FISH_MODEL_ENDPOINT = "https://api.fish.audio/model"
MIMO_BASE_URL = "https://api.xiaomimimo.com/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.py (reported line 35)May include surrounding context.

python
FISH_KEY_URL = "https://fish.audio/app/api-keys/"
MIMO_KEY_URL = "https://platform.xiaomimimo.com/#/console/api-keys"
MIMO_REGISTER_URL = "https://id.mi.com/"
FISH_TTS_ENDPOINT = "https://api.fish.audio/v1/tts"
FISH_MODEL_ENDPOINT = "https://api.fish.audio/model"
MIMO_BASE_URL = "https://api.xiaomimimo.com/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.py (reported line 36)May include surrounding context.

python
FISH_KEY_URL = "https://fish.audio/app/api-keys/"
MIMO_KEY_URL = "https://platform.xiaomimimo.com/#/console/api-keys"
MIMO_REGISTER_URL = "https://id.mi.com/"
FISH_TTS_ENDPOINT = "https://api.fish.audio/v1/tts"
FISH_MODEL_ENDPOINT = "https://api.fish.audio/model"
MIMO_BASE_URL = "https://api.xiaomimimo.com/v1"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/mimo-api.md (reported line 8)May include surrounding context.

md
MIMO_REGISTER_URL = "https://id.mi.com/"
FISH_TTS_ENDPOINT = "https://api.fish.audio/v1/tts"
FISH_MODEL_ENDPOINT = "https://api.fish.audio/model"
MIMO_BASE_URL = "https://api.xiaomimimo.com/v1"


def mask(key: str) -> str:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.py (reported line 37)May include surrounding context.

python
MIMO_REGISTER_URL = "https://id.mi.com/"
FISH_TTS_ENDPOINT = "https://api.fish.audio/v1/tts"
FISH_MODEL_ENDPOINT = "https://api.fish.audio/model"
MIMO_BASE_URL = "https://api.xiaomimimo.com/v1"


def mask(key: str) -> str:

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and all CLI-facing help/output strings are written in Chinese, which imposes a specific language on users. The file does not provide an opt-in, alternate locale, or documented region-specific justification for this restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The sync operation persists remote voice metadata to voices_cache.json via save_cache(), but cmd_sync only reports completion after the write and does not warn beforehand that local data will be created or updated. For a code-file warning check, file writes that affect local user data should have some visible disclosure unless clearly communicated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The CLI description and help strings are written only in Chinese, and the script's status/error messages throughout execution are also emitted in Chinese. This imposes a specific language/locale on users without any opt-in or alternative, which matches the language-policy concern for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The JSON note at L1 is written only in Chinese, which can constitute a language-policy issue if the skill is expected to be usable in a broader locale context. There is no accompanying alternative language, opt-in mechanism, or justification that this file is region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.