Text To Speech

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:51 AM UTC
• Version: 1.0.0

Overview

The skill performs text-to-speech, but it may send submitted text to an external TTS service without clearly warning the user.

Review before installing if you may convert confidential, regulated, personal, or secret text. Use it only with text you are comfortable sending to a third-party TTS provider unless you verify an offline backend, and keep output paths inside a safe working directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/tts.py:27

Finding

Undisclosed Transmission of User Text to an External TTS Service

Content

View full analysis

Vulnerability Details

File Location: scripts/tts.py, lines 27-32
Vulnerability Type: Undisclosed third-party data transmission
Risk Level: Medium

Vulnerable Code

python

def tts_gtts(text, output, lang='en'):
    """Use gTTS for TTS."""
    try:
        from gtts import gTTS
        tts = gTTS(text, lang=lang)
        tts.save(output)

Technical Analysis

The supplied text is passed to the gTTS library for network-backed speech synthesis. This causes user-controlled content to be transmitted to an external Google TTS service. The skill documentation describes text-to-speech conversion but does not disclose that submitted text leaves the local environment.

This is particularly relevant because text submitted for narration may include confidential documents, personal information, internal business data, or other sensitive content. No consent, sensitivity warning, offline mode, or content filtering control is implemented.

Attack Path

1. A user invokes the skill with text containing confidential or personal information.
2. main() passes the supplied text to tts_gtts().
3. gTTS(text, lang=lang) prepares the content for remote synthesis.
4. tts.save(output) contacts the external service and sends the text as part of the synthesis request.
5. The external service may process, log, or retain the submitted content according to policies outside the user's local security boundary.

Impact Assessment

The issue does not grant local operating-system privileges or direct code execution. Its impact is loss of confidentiality for all text submitted to the skill. Exposure is limited to the supplied text and associated request metadata, but may include highly sensitive information depending on how the skill is used.

Remediation

View remediation

Remediation Suggestions

• Clearly disclose in SKILL.md that the default backend sends supplied text to an external service.
• Require explicit user consent before transmitting content.
• Warn users not to submit secrets, credentials, regulated data, or confidential documents.
• Provide an explicitly selected offline TTS backend for sensitive workloads.
• Add a configuration option that disables all network-backed synthesis.
• Document the external provider's applicable privacy, retention, and data-processing policies.
• Consider implementing sensitivity checks or confirmation prompts before external transmission.

T08 · Insecure Dependencies

Note

• Location: scripts/tts.py:34

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/tts.py, lines 34-38
Vulnerability Type: Insecure dependency management
Risk Level: Low

Vulnerable Code

python

    except ImportError:
        print("gTTS not installed. Run: pip install gtts")
        return tts_say(text, output)
    except Exception as e:
        print(f"Error: {e}")

The module-level documentation also recommends the same unconstrained installation:

python

Note: Uses gTTS (pip install gtts) for free TTS, or falls back to macOS say command.

Technical Analysis

The skill directs users to install gtts without specifying an audited version, cryptographic hashes, a lock file, or an approved package source. Consequently, dependency resolution retrieves whichever release is current when the command is executed.

This creates a mutable supply-chain boundary: a future compromised or malicious package release could be installed without the skill itself changing. Unpinned installation also increases the risk of incompatible updates and makes audited builds difficult to reproduce.

The reviewed project does not itself retrieve or install the package automatically, and there is no evidence that the named package is currently malicious. Exploitation therefore depends on the user following the displayed instruction and the resolved package or package-distribution channel being compromised.

Attack Path

1. The script is executed in an environment where gTTS is absent.
2. The ImportError handler instructs the user to run pip install gtts.
3. The user executes the unconstrained installation command.
4. The package manager resolves a mutable release from its configured package index.
5. If the selected release, distribution artifact, index, or dependency has been compromised, attacker-controlled code may run during installation or when gtts is imported.
6. That code executes with the privileges of the user or ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

• Declare gTTS in a version-controlled dependency file using a reviewed, exact version.
• Use cryptographic hashes, such as pip's --require-hashes, to verify downloaded artifacts.
• Generate and commit a lock file to make installations reproducible.
• Document an approved package index and avoid untrusted extra indexes.
• Install the dependency inside an isolated virtual environment with least privilege.
• Add automated dependency vulnerability and integrity scanning.
• Review and deliberately update the pinned version rather than resolving the latest release at runtime.

SkillSpector

Vulnerability Patterns

• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The output path is accepted without validation and is passed directly to the say command's -o option, allowing writes to arbitrary filesystem locations accessible to the current user. In an agent or automation context, a malicious user could overwrite or create files outside the intended working directory, causing data loss, tampering with local files, or interfering with other processes.

Content

Scanner excerpt · scripts/tts.py (reported line 50)May include surrounding context.

python

# Check if we're on macOS
        if sys.platform == 'darwin':
            # Convert to mp3 using afplay/ffmpeg if available
            subprocess.run(['say', '-o', output.replace('.mp3', '.aiff'), text], check=True)
            print(f"Saved to: {output}")
            return 0
        else:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill demonstrates shell-based execution via python scripts/tts.py ... but does not declare any permissions or allowed-tools scope. This creates an authorization gap where an agent may invoke shell capabilities without an explicit least-privilege policy, increasing the risk of unintended command execution or misuse if user-controlled text or file paths are passed through the shell.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module presents itself as converting text to audio, and the fallback function prints that it saved to the user-specified output path. However, the code invokes say -o with output.replace('.mp3', '.aiff'), so it writes a different file than the one reported unless the caller explicitly asked for an AIFF path. This is an active contradiction between the user-facing behavior/documentation and the actual file written.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts.py (reported line 50)May include surrounding context.

python

# Check if we're on macOS
        if sys.platform == 'darwin':
            # Convert to mp3 using afplay/ffmpeg if available
            subprocess.run(['say', '-o', output.replace('.mp3', '.aiff'), text], check=True)
            print(f"Saved to: {output}")
            return 0
        else:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts.py (reported line 72)May include surrounding context.

python

# Try macOS voices
    try:
        result = subprocess.run(['say', '-v', '?'], capture_output=True, text=True)
        if result.returncode == 0:
            print("\nmacOS Voices:")
            for line in result.stdout.strip().split('\n')[:20]:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code sets the default language to 'en' via the --lang argument, which imposes a specific locale unless the user overrides it. The policy allows locale constraints when users are given a choice or opt in, but here the default behavior is English-first rather than language-neutral.

Content

No source excerpt is available for this finding.