Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local voice toolkit, but its install path asks users or agents to run mutable remote/global installers with broad local code execution authority.
Review the install commands before using this skill. Prefer package-manager or pinned installation methods where possible, avoid piping remote installers directly into a shell, run it as a normal non-admin user, and be aware that installation persists a global CLI plus model assets and can change OpenClaw audio/TTS behavior.
The documented installation procedures pass a mutable network response directly to Bash or PowerShell. Neither command pins an installer version, verifies a cryptographic signature or checksum, nor provides an inspection boundary between downloading and executing the content.
The URL appears to use Bun's official domain, which reduces typo-squatting risk, but domain and TLS trust alone do not establish payload immutability. A compromise of the publisher's infrastructure, domain, CDN, installer-generation process, or signing account could change the script after this Skill has been audited.
This behavior is not required for the Skill's voice-processing functionality. The README already identifies Homebrew and other package-based installation options that avoid directly piping a response into a shell.
Attack Path
An attacker compromises an upstream service involved in serving bun.sh/install or bun.sh/install.ps1.
The attacker replaces the expected installer response with commands that perform unauthorized actions.
A user follows the Quick Start instructions.
curl | bash or irm | iex executes the response immediately, without local review or integrity verification.
The payload operates with all permissions available to the invoking user and can download or launch additional components.
Impact Assessment
Successful exploitation provides arbitrary command execution with the invoking user's privileges. The payload could read or modify user-accessible files, access credentials available to that account, alter shell configuration, install additional software, or
...[truncated 150 chars]
Remediation
View remediation
Remediation Suggestions
Make a signed operating-system package manager installation method the primary recommendation.
Do not pipe downloaded content directly into a shell.
If a script installer must be supported, download it to a local file first.
Pin the installer to a specific release rather than a mutable endpoint.
Publish and verify a cryptographic signature or a checksum obtained through an independently protected channel.
Allow users to inspect the downloaded script before execution.
Explicitly instruct users not to run the installer with sudo or from an elevated PowerShell session unless a documented operation requires it.
# 2. Install Kesha:
bun add -g @drakulavich/kesha-voice-kit
kesha --version # confirms `kesha` resolved on PATH
kesha install --plan # preview exact download/disk sizes first — downloads nothing
kesha install # ~2.5 GB on Linux/Windows; ~0.6 GB on Apple Silicon, whose CoreML
Technical Analysis
The package installation does not specify an exact reviewed version or integrity value. Consequently, the package manager resolves the package version at installation time, and its effective contents may differ from those available during this audit.
The newly installed executable is then trusted to run kesha install, which downloads substantial engine and model assets. The reviewed project contains only documentation and Skill instructions, not the package implementation, download manifest, or verification logic. The audit therefore cannot independently confirm whether package lifecycle behavior or downloaded assets are cryptographically authenticated.
The package scope matches the linked npm project, and no evidence of typo-squatting or a currently malicious package was found. The vulnerability is the mutable, unverified supply-chain trust path rather than proof that the named package is presently malicious.
Attack Path
An attacker compromises the package publisher account, package registry, release automation, or another upstream distribution component.
The attacker publishes a modified release under the same unp
...[truncated 1003 chars]
Remediation
View remediation
Remediation Suggestions
Pin the CLI to an exact audited version, such as @drakulavich/kesha-voice-kit@X.Y.Z, rather than resolving the current release.
Pin and verify package integrity using a trusted lockfile or registry-provided integrity metadata.
Document whether the package defines lifecycle scripts and disable them during installation when they are not necessary.
Publish signed release artifacts and a signed, versioned manifest covering every engine binary and model downloaded by kesha install.
Verify cryptographic hashes and signatures before executing binaries or loading downloaded assets.
Fail closed when verification is unavailable or unsuccessful.
Keep kesha install --plan as a preview step, but extend it to display exact artifact versions, source URLs, hashes, signatures, and destination paths.
Prefer installation in a dedicated, non-administrative account or isolated environment and restrict write access to the minimum directories needed for the CLI and model cache.
Preserve offline installation and corporate mirror options using the same signature-verification requirements.
The README instructs users to execute a remote install script directly via curl ... | bash, which bypasses review of the downloaded content and gives the remote server immediate code execution on the user's machine. If the hosting site, DNS, TLS termination, or distribution pipeline were ever compromised, users following these instructions could run attacker-controlled code during installation.
Content
Scanner excerpt · README.md (reported line 31)May include surrounding context.
bash
# 1. Install Bun (skip if you have it) — Linux & macOS:
curl -fsSL https://bun.sh/install | bash # or: brew install oven-sh/bun/bun
# Windows: powershell -c "irm bun.sh/install.ps1 | iex"
# if `bun --version` fails, reload PATH: exec $SHELL -l
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The trigger keyword list contains very broad terms such as "say," "opus," "privacy," and common audio-related words that may appear in many unrelated conversations. In an agent environment, this can cause the skill to activate outside its intended scope, leading to unnecessary execution of local binaries, unintended handling of user audio/text, or workflow hijacking from more appropriate skills.
