ClawHub
Back to skill

Security audit

Volcengine TTS Audio Synthesis

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it sends user-provided text and Volcengine credentials to Volcengine's TTS API and saves generated audio locally.

Install only if you are comfortable sending the text you synthesize, plus your Volcengine app credentials, to Volcengine's online TTS service. Use a dedicated Volcengine token, keep it out of shared request files and logs, prefer a virtual environment with pinned dependencies, and delete saved payloads or metadata if they contain sensitive text or credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Tainted flow: 'body' from os.environ.get (line 94, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 132)May include surrounding context.

python
"Content-Type": "application/json",
        "Authorization": f"Bearer;{token}",
    }
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 55)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 58)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 60)May include surrounding context.

python
def _load_env() -> None:
    _load_dotenv(Path.cwd() / ".env")
    repo_root = _find_repo_root(Path(__file__).resolve())
    if repo_root:
        _load_dotenv(repo_root / ".env")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and operationalizes environment-variable access, local file reads/writes, and outbound network access, but it does not declare any tool scope or permissions boundary. That mismatch is dangerous because an agent or reviewer cannot reliably understand or constrain what the skill is allowed to do, increasing the risk of unintended secret access, local data exposure, or unreviewed external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs saving generated audio, request payloads, and response metadata locally, but the user-facing description does not warn that these artifacts may contain sensitive user text, voice content, identifiers, or service metadata. In a TTS context this is especially relevant because input text often includes private or regulated content, so silent persistence can create privacy, compliance, and retention risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script transmits arbitrary input text and authentication material to an external cloud service without an explicit runtime warning or confirmation step. In an agent/skill context, users may not realize sensitive prompts, PII, or proprietary text will leave the local environment, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_tts.py (reported line 132)May include surrounding context.

python
"Content-Type": "application/json",
        "Authorization": f"Bearer;{token}",
    }
    resp = requests.post(TTS_API_URL, json=body, headers=headers, timeout=60)
    resp.raise_for_status()
    data = resp.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

SQP-3 要求检查自然语言中的语言/区域政策问题。该参考文档从标题到正文均固定为中文，未说明这是面向特定中文用户群的限定文档，也未提供其他语言选项或用户选择。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

该文件是 markdown，因此需要检查是否对可能影响隐私或系统安全的行为提供说明。L73 提到 token 可由环境变量注入，这涉及凭证使用，但文档没有提醒用户保护凭证、避免提交到请求文件或日志中。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This code creates directories and writes audio bytes to a local file path, which affects the user's filesystem. There is no explicit print/log statement or warning describing that a file will be created or overwritten at the resolved output path.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.