Security audit

声音克隆通义 Qwen Audio Clone

Security checks for vulnerabilities and agentic risk

Overview

This voice-cloning skill is mostly purpose-aligned, but it handles sensitive voice data and has misleading command/output documentation that users should review before installing.

Review this before installing because it uploads voice samples to a hosted service and stores or uses a dLazy API key. Only use voice samples you have rights and consent to clone, and verify the real CLI help/output because the published examples contain image-generation and --prompt documentation errors.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
[English](./SKILL.md) · [中文](./SKILL-cn.md)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is documented throughout as a Qwen TTS voice-cloning tool, which implies audio-related outputs or voice-profile creation. However, the output schema shows type: "image", a PNG MIME type, and a result.png URL, which actively conflicts with the intended behavior and would mislead users or agents about what the command returns.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented CLI options for dlazy qwen-audio-clone list --audio_url, --name, and --description, but the example invocation uses --prompt and the error table says --prompt is required. This is an active contradiction in the documentation that misrepresents how the tool is actually supposed to be invoked.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL-cn.md (reported line 123)May include surrounding context.
md
## 错误处理 | Code | 错误类型 | 示例信息 | | ---- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | 401 | 未授权 (API Key缺失或无效) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` | | 501 | 缺少必填参数 | `error: required option '--prompt <prompt>' not specified` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This skill handles voice cloning, which processes biometric voice data and can facilitate impersonation if samples are uploaded without consent. The absence of an explicit warning about consent, identity misuse, retention, and privacy expectations increases the risk of unauthorized cloning and unsafe handling of sensitive personal data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is described throughout the manifest as a qwen3-tts voice cloning tool, but the documented output schema shows an image result (type: "image", result.png) and the example invocation uses --prompt rather than the documented audio-clone parameters. This is not merely incomplete documentation; it actively describes behavior associated with image generation instead of voice cloning.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
## Error Handling | Code | Error Type | Example Message | | ---- | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | 401 | Unauthorized (No API Key) | `ok: false, code: "unauthorized", message: "API key is missing or invalid"` | | 501 | Missing required parameter | `error: required option '--prompt <prompt>' not specified` |

Static analysis

No suspicious patterns detected.