Volcengine TTS Audio Synthesis

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it sends user-provided text and Volcengine credentials to Volcengine's TTS API and saves generated audio locally.

Install only if you are comfortable sending the text you synthesize, plus your Volcengine app credentials, to Volcengine's online TTS service. Use a dedicated Volcengine token, keep it out of shared request files and logs, prefer a virtual environment with pinned dependencies, and delete saved payloads or metadata if they contain sensitive text or credentials.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:21
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:21` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Low ### Vulnerable Code ```bash pip install requests ``` ### Technical Analysis The installation instructions retrieve the latest available version of `requests` without specifying an exact version or verifying package integrity. Consequently, installations performed at different times may resolve to different dependency versions and transitive dependency sets. The package name is legitimate and there is no evidence that the project intentionally installs a malicious dependency. However, the absence of version and hash constraints weakens reproducibility and supply-chain security. A future compromised release, maliciously altered package index response, or incompatible dependency update could introduce attacker-controlled code during installation. The script imports `requests` at startup, so any malicious code introduced through the installed package or its dependencies could execute when `scripts/generate_tts.py` runs. ### Attack Path 1. An attacker compromises a future `requests` release, one of its transitive dependencies, or the package distribution channel used by the environment. 2. A user follows the documented `pip install requests` instruction. 3. `pip` resolves and installs the affected unconstrained release. 4. The user invokes `scripts/generate_tts.py`. 5. Python imports the installed package, allowing malicious initialization code to execute with the privileges of the user running the script. 6. Such code could access the TTS credentials loaded into the process environment, local files accessible to that user, and available network resources. ### Impact Assessment Exploitation could execute code with the privileges of the installing or invoking user. The accessible scope may include local user files, generated audio, request content, and environment variables such as `VOLCENGINE_TTS_APP_ID` ...[truncated 565 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `requests` and all transitive dependencies to reviewed versions using a lock file or constraints file. - Install with integrity verification, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Generate `requirements.txt` with exact versions and SHA-256 hashes from a trusted environment. - Review and update pinned dependencies through a controlled process that includes vulnerability scanning and compatibility testing. - Use an isolated virtual environment and a trusted package index. - Avoid running package installation or the TTS script with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tainted flow: 'body' from os.environ.get (line 94, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"Content-Type": "application/json",
        "Authorization": f"Bearer;{token}",
    }
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and operationalizes environment-variable access, local file reads/writes, and outbound network access, but it does not declare any tool scope or permissions boundary. That mismatch is dangerous because an agent or reviewer cannot reliably understand or constrain what the skill is allowed to do, increasing the risk of unintended secret access, local data exposure, or unreviewed external requests.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs saving generated audio, request payloads, and response metadata locally, but the user-facing description does not warn that these artifacts may contain sensitive user text, voice content, identifiers, or service metadata. In a TTS context this is especially relevant because input text often includes private or regulated content, so silent persistence can create privacy, compliance, and retention risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script transmits arbitrary input text and authentication material to an external cloud service without an explicit runtime warning or confirmation step. In an agent/skill context, users may not realize sensitive prompts, PII, or proprietary text will leave the local environment, creating privacy and data-handling risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"Content-Type": "application/json",
        "Authorization": f"Bearer;{token}",
    }
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: SQP-3 要求检查自然语言中的语言/区域政策问题。该参考文档从标题到正文均固定为中文，未说明这是面向特定中文用户群的限定文档，也未提供其他语言选项或用户选择。

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: 该文件是 markdown，因此需要检查是否对可能影响隐私或系统安全的行为提供说明。L73 提到 `token` 可由环境变量注入，这涉及凭证使用，但文档没有提醒用户保护凭证、避免提交到请求文件或日志中。

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This code creates directories and writes audio bytes to a local file path, which affects the user's filesystem. There is no explicit print/log statement or warning describing that a file will be created or overwritten at the resolved output path.

Static analysis

No suspicious patterns detected.