Volcengine TTS to TOS Agent

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

This skill performs the advertised text-to-speech, cloud upload, and temporary link workflow without hidden execution, persistence, deletion, or unrelated data access.

Install and run this in an isolated environment, pin dependency versions where possible, provide Volcengine credentials scoped to only the required TOS bucket/prefix, avoid sensitive text unless you accept sending it to Volcengine services, and keep presigned URL expirations short.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippet:

bash

- `pip install requests tos`

Technical Analysis

The installation instructions retrieve the latest available versions of requests and tos without version constraints, cryptographic hashes, or a lock file. This makes the installed code mutable after the Skill has been reviewed. A compromised package release, malicious dependency update, or other package-registry supply-chain incident could cause unreviewed code to run during installation or import.

This exposure is security-sensitive because the imported packages participate in network operations and execute in a process that can access VOLCENGINE_TTS_TOKEN, VOLCENGINE_ACCESS_KEY, VOLCENGINE_SECRET_KEY, user-provided text, and generated audio. The audit did not identify evidence that the package names are typosquatted or currently malicious; the finding concerns the absence of reproducible and integrity-verified dependency resolution.

Attack Path

1. An attacker compromises a dependency release, a transitive dependency, or its distribution channel.
2. A user follows the documented pip install requests tos command.
3. The package manager resolves and installs the attacker-controlled version because no reviewed version or hash is required.
4. Malicious code executes during package installation, import, or a subsequent API call.
5. When the Skill runs, that code can read credentials available to the process, inspect user text and audio, transmit data externally, or perform actions with the process owner's permissions.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user installing or running the Skill. It could expose Volcengine TTS and TOS credentials, synthesized text and audio, and other files or environment ...[truncated 528 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to a reviewed, exact version, for example through a version-controlled requirements file.
2. Generate and commit a lock file that also fixes all transitive dependency versions.
3. Require cryptographic hashes during installation, such as with pip install --require-hashes -r requirements.txt.
4. Obtain packages only from an approved package index and verify package ownership and provenance.
5. Use automated dependency scanning and controlled update reviews before changing pinned versions.
6. Install and run the Skill in an isolated virtual environment or container under a non-privileged account.
7. Scope TOS credentials to only the required bucket, object prefix, and operations, and use short-lived credentials where supported.
8. Avoid exposing unrelated secrets to the Skill process, limiting the impact of any future dependency compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tainted flow: 'headers' from os.environ.get (line 130, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/tts_to_tos.py (reported line 131)May include surrounding context.

python

body["audio"]["language"] = language

    headers = {"Content-Type": "application/json", "Authorization": f"Bearer;{token}"}
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tts_to_tos.py (reported line 80)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tts_to_tos.py (reported line 83)May include surrounding context.

python

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes capabilities that require environment access, local file handling, and outbound network access, but it does not declare any tool scope or permission boundaries. In an agent environment, missing explicit scoping increases the chance of over-privileged execution, unclear operator expectations, and abuse of credentials or filesystem/network access beyond what users intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description does not clearly warn that user-provided text is sent to external cloud services for synthesis and that the resulting audio is uploaded to object storage and exposed through a shareable presigned URL. This can lead users to disclose sensitive content without informed consent and can cause unintended data exposure if the URL is shared, logged, or retained longer than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tts_to_tos.py (reported line 131)May include surrounding context.

python

body["audio"]["language"] = language

    headers = {"Content-Type": "application/json", "Authorization": f"Bearer;{token}"}
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 55% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · scripts/tts_to_tos.py (reported line 180)May include surrounding context.

python

) -> dict[str, Any]:
    """Upload audio bytes to TOS and return metadata."""
    client = _get_tos_client()
    resp = client.put_object(bucket, key, content=audio_bytes, content_type=content_type)
    return {
        "bucket": bucket,
        "key": key,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language instructions, workflow, parameters, and safety guidance are presented in Chinese, which effectively forces a specific language for users reading the skill documentation. There is no indication that the skill is region-specific or that alternative language support is offered.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This file contains natural-language examples using Chinese text and a language hint example of "cn", which can imply a preferred locale. The script does accept arbitrary text and an optional --language parameter, but the surrounding natural-language guidance does not clearly state that users may choose their own language/locale.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes a skill that synthesizes speech, uploads it to TOS, and returns a presigned temporary URL. The optional --keep-local path adds an extra behavior—saving a local copy on disk—that is not mentioned as part of that scope and is not necessary to produce the shareable link.

Content

No source excerpt is available for this finding.