Security audit

语音合成 ElevenLabs TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed wrapper for a hosted dLazy/ElevenLabs text-to-speech command, with some documentation mistakes but no evidence of hidden or unsafe behavior in the artifact.

Install only if you are comfortable using a third-party hosted TTS service, sending prompts and selected parameters to dLazy, and storing a dLazy API key locally through the CLI. Review the pinned npm package/source if your environment has stricter supply-chain requirements; the skill documentation should also be corrected so examples show audio output rather than image output.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file documents this skill as ElevenLabs text-to-speech, but the sample output shows an output object with type "image", a .png URL, and mimeType "image/png". That directly contradicts the stated purpose of generating speech/audio and could mislead an agent about what the command actually returns.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL-cn.md (reported line 128)May include surrounding context.
md
## 错误处理 | Code | 错误类型 | 示例信息 | | ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` | | 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The agent instructions require the assistant to explicitly tell the user specific messages in Chinese and direct them to follow-up steps, but do not offer a language choice or state that this locale restriction is optional. This is a natural-language locale policy issue because it prescribes a specific language behavior without user opt-in.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
## Error Handling | Code | Error Type | Example Message | | ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | 401 | Unauthorized (No API Key) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` | | 501 | Missing required parameter | `error: required option '--prompt <prompt>' not specified` |

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The error example says "Image file/Video file not found", but the documented command options for this skill are prompt and voice controls for TTS, not image or video inputs. This is an active documentation contradiction suggesting copied behavior from another media skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented JSON example for this ElevenLabs TTS skill shows an output object with type: "image", a .png URL, and image/png MIME type, which contradicts the skill's stated purpose of generating speech audio. This is active documentation-to-behavior intent divergence, not just an omission, because it explicitly describes the wrong media type.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The error table includes Local file read error with the example Image file/Video file not found, but the exposed command options for this skill are text prompt and voice controls, not image or video inputs. This contradicts the documented interface and suggests copied guidance from a different media-generation skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.