Sherpa Onnx Tts Local

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local text-to-speech helper, but users should understand it downloads native runtime archives from GitHub during installation.

Install only if you are comfortable downloading native sherpa-onnx binaries from the listed GitHub release. Prefer running it as a normal user, choose a different voice model if needed, and avoid reusing an output filename you do not want overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Downloaded Native Runtime Archives Lack Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-43` **Vulnerability Type**: Unverified third-party native executable dependency **Risk Level**: Medium The Skill automatically downloads and extracts platform-specific sherpa-onnx runtime archives containing native executable code. The release version is pinned and the URLs point to the apparent upstream GitHub repository, but no cryptographic checksum or signature verification is configured. ```json { "id": "download-runtime-macos", "kind": "download", "os": ["darwin"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-osx-universal2-shared.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (macOS)", }, { "id": "download-runtime-linux-x64", "kind": "download", "os": ["linux"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-linux-x64-shared.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (Linux x64)", }, { "id": "download-runtime-win-x64", "kind": "download", "os": ["win32"], "url": "https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.12.23/sherpa-onnx-v1.12.23-win-x64-shared.tar.bz2", "archive": "tar.bz2", "extract": true, "stripComponents": 1, "targetDir": "runtime", "label": "Download sherpa-onnx runtime (Windows x64)", }, ``` ### Technical Analysis Downloading the sherpa-onnx runtime is functionally necessary for the declared offline text-to-speech capability and does not inherently exceed the minimum privileges required by that functionality. Version pinning also limits accidental upgrades. However, URL and version pinning do not establish artifact integrity. The installer extracts remotely hosted archives without checking a pinned SHA-256 digest or a trusted cryptograp ...[truncated 1791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Record a reviewed SHA-256 or stronger digest for each macOS, Linux, and Windows runtime archive in the installation metadata. 2. Verify the complete downloaded archive against the pinned digest before extraction, and fail closed on any mismatch. 3. Prefer upstream-signed artifacts and verify signatures using a pinned, independently validated signing key. 4. Apply equivalent integrity verification to the downloaded voice-model archive, even though it is data rather than the primary native runtime. 5. Perform verification before parsing or extracting archives to reduce exposure to malicious archive content. 6. Review and update pinned digests deliberately whenever the sherpa-onnx version changes. 7. Restrict installation and runtime directories to the invoking user and avoid running installation or TTS execution with administrator or root privileges. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The manifest and installation instructions select the `en_US` Lessac voice model as the default, and the documentation does not present locale selection as an explicit user choice. Because SQP-3 applies to all file types, this natural-language and config-level preference for a specific locale can violate language/locale policy when no opt-in is provided.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: This is a markdown file, so SQP-2 applies to omissions in the skill description. The usage example shows creation of `./tts.wav`, which affects user data on disk, but the document does not explicitly warn that running the command will write or overwrite a local file.

Static analysis

No suspicious patterns detected.