Security audit

free-tts

Security checks across malware telemetry and agentic risk

Overview

This skill sends user-selected text and voice samples to third-party TTS services, and the sensitive behavior is disclosed, purpose-aligned, and user-directed.

Install only if you are comfortable sending synthesis text and any selected voice samples to Fish Audio or Xiaomi MiMo. Use voice cloning only with the speaker's consent, avoid sensitive or regulated recordings on free tiers, and remember that API keys and Fish voice IDs/models may persist until you remove them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill clearly instructs use of environment variables, file reads/writes, and outbound network access, but it does not declare permissions or equivalent capability boundaries. This creates a transparency and consent problem: a host or user may invoke the skill without realizing it can store secrets, access local files, and call external TTS providers.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The activation guidance is broad: it triggers on generic TTS, dubbing, cloning, and vendor keywords without meaningful exclusions. Over-broad routing can cause the agent to select this skill in contexts involving sensitive voice cloning, unexpected external API use, or cases where the user did not intend third-party processing.

Natural-Language Policy Violations

Medium

Confidence: 80% confidence
Finding: The description is written to route Chinese-language interaction by default and centers Chinese phrasing without indicating fallback behavior or user choice. This can degrade user autonomy and cause incorrect skill activation or response-language mismatches, though it is more of a policy/usability security issue than a direct exploit path.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document explicitly promotes voice cloning in a free external service but does not clearly warn that user audio and transcripts are uploaded to a third party and that request data may be used for model improvement. In a TTS/voice-cloning skill, this omission is security-relevant because users may unknowingly submit biometric voice data and sensitive content to an external provider.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When --reference-audio is used, the script base64-encodes the user’s reference voice sample and sends it, along with transcription text and synthesis text, to a third-party API. Voice samples and text can contain sensitive biometric or personal data, and the script does not present an explicit privacy warning or consent gate at the point of transmission, which increases the risk of unintentional disclosure.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: In voice-clone mode, the script reads the user-provided audio file, base64-encodes it, and embeds it directly into the request sent to Xiaomi's remote API. That is an actual data-transmission/privacy risk because clone audio is highly sensitive biometric data, and the script does not present an explicit runtime warning or consent checkpoint before upload.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.