Qwen3/Free Text-to-Speech and Voice Cloning

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

This voice-cloning skill is coherent in purpose, but its setup can run remote installer code and fetch unpinned packages/models despite prominent offline claims.

Review this before installing. It is a local TTS and voice-cloning skill, but first-time setup is not fully offline: it may install Homebrew, fetch packages, upgrade pip, install mlx-audio, and download a large model from external sources. Prefer manual, reviewed installation steps, pin dependencies where possible, and only clone voices you own or have explicit permission to use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install_dependencies.sh:11
• Finding: Unverified Remote Homebrew Installer Is Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `install_dependencies.sh`, line 11 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ``` ### Technical Analysis The one-click installer retrieves a shell script from the mutable `HEAD` revision of an external GitHub repository and passes the response directly to Bash. No immutable commit, checksum, or cryptographic signature is used to verify the downloaded content before execution. HTTPS protects the connection in transit, but it does not guarantee that content hosted at this mutable URL will remain identical to the content reviewed during this audit. Compromise of the upstream repository, maintainer credentials, release process, or applicable trust infrastructure could therefore change the effective code executed by this Skill after publication. Automatically bootstrapping Homebrew is also broader than the minimum behavior necessary for local text-to-speech inference. Homebrew installation can alter package-management state, create directories, and recommend or perform shell configuration changes. It should be treated as a separate, explicitly authorized system setup operation rather than an implicit Skill dependency step. ### Attack Path 1. A user follows the documented one-click installation procedure. 2. The script determines that the `brew` command is unavailable. 3. It downloads the current content of the Homebrew installer from the mutable `HEAD` branch. 4. The response is supplied directly to `/bin/bash` without inspection or integrity verification. 5. If the remote content or delivery path has been compromised, attacker-controlled shell commands execute with the permissions of the user running the installer. 6. Those commands may read or modify any files and resources accessible to that user and may attempt additional privilege requests ...[truncated 536 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic Homebrew bootstrapping from the Skill installer. 2. If Homebrew is absent, stop safely and direct the user to independently reviewed official installation instructions. 3. Prefer a project-local Python virtual environment rather than modifying a global Python environment. 4. If remote script retrieval is unavoidable: - Pin the URL to a reviewed immutable commit. - Download the file without executing it. - Verify a trusted cryptographic signature or a separately distributed SHA-256 checksum. - Present the planned operation to the user and require explicit confirmation. - Execute only after successful verification. 5. Document every filesystem or shell-profile change that the prerequisite installer may make. ]]>

T08 · Insecure Dependencies

Warning

• Location: install_dependencies.sh:16
• Finding: Unpinned Third-Party Dependencies and Installation-Time Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `install_dependencies.sh`, lines 16-21; related lifecycle command in `package.json`, line 8 **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash brew install python@3.10 ffmpeg # Install Python dependencies echo "Installing Python dependencies..." python3.10 -m pip install --upgrade pip python3.10 -m pip install mlx-audio ``` The corresponding package lifecycle command is: ```json "install": "brew install python@3.10 ffmpeg && python3.10 -m pip install mlx-audio" ``` ### Technical Analysis The installer resolves Homebrew formulae, pip, and `mlx-audio` from mutable upstream package repositories without exact versions, hashes, or a lock file. Consequently, the dependency graph executed today may differ from the graph originally reviewed. Python package installation can execute package build hooks and other installation-time code. If `mlx-audio`, one of its transitive dependencies, or the applicable package repository is compromised, malicious code could run during installation. Implicitly upgrading pip further changes the trusted installer component without pinning or integrity verification. The `package.json` entry uses the reserved npm `install` lifecycle name. Package managers may invoke this lifecycle automatically during installation, which can unexpectedly trigger Homebrew and pip operations rather than requiring a clearly named, deliberate setup command. ### Attack Path 1. A user runs `install_dependencies.sh` or installs the package in a way that invokes its npm `install` lifecycle. 2. Homebrew and pip resolve the latest packages and transitive dependencies allowed by the unpinned commands. 3. An upstream package, formula, build artifact, or transitive dependency has been compromised or replaced with a malicious release. 4. The package manager downloads the altered component. 5. Build or installation hooks execute attacker-controlled code ...[truncated 689 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin reviewed versions of all direct dependencies. 2. Generate and commit a Python lock or constraints file that records transitive versions and artifact hashes. 3. Install Python packages with hash enforcement, such as `pip install --require-hashes -r requirements.txt`. 4. Avoid automatically upgrading pip. Pin and verify a reviewed pip version only when an upgrade is necessary. 5. Pin or otherwise document tested Homebrew formula revisions where practical. 6. Create and use a project-local virtual environment instead of installing into a global Python environment. 7. Rename the npm `install` lifecycle command to an explicit command such as `setup`, so dependency installation does not unexpectedly modify system package state. 8. Review package provenance, release signatures, build configuration, and transitive dependencies before updating pinned versions. ]]>

other

Note

• Location: SKILL.md:17
• Finding: Offline and Privacy Claims Do Not Disclose Required Initial Network Retrieval<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-18; model download behavior documented around lines 134-135 and invoked by `voice_cloning_demo.py`, lines 49-51 and 98-100 **Vulnerability Type**: Misleading network-requirement disclosure **Risk Level**: Low ### Relevant Code and Documentation The documentation makes unconditional offline claims: ```markdown 🆓 **Completely free** local text-to-speech (TTS) and voice cloning skill. No API key required, no internet needed, unlimited usage. Supports **voice cloning**, **text-to-speech**, and **translation dubbing**. High-quality **100% FREE** local TTS voice synthesis and voice cloning skill. No API key required, no internet needed, unlimited usage. ``` The demo loads a named external model that may be downloaded on first use: ```python print("Loading model...") model = load_model('mlx-community/Qwen3-TTS-12Hz-1.7B-Base-8bit') ``` The documentation separately acknowledges this behavior: ```python # Load model (auto-downloads on first run, ~3GB) model = load_model('mlx-community/Qwen3-TTS-12Hz-1.7B-Base-8bit') ``` ### Technical Analysis Inference appears to run locally after the required dependencies and model files are present. However, installation retrieves packages, and the first model load can automatically download approximately 3 GB from an external model source. The prominent unconditional statement that no internet connection is needed is therefore incomplete. Users may interpret it as meaning that installation and first execution never communicate with external services. The later model-download comment does not fully correct the earlier privacy and offline assurance. The audited project code does not contain logic that uploads reference audio or synthesis text. This finding concerns transparency about inbound network retrieval, not confirmed exfiltration of voice data. ### Attack Path 1. A user relies on the prominent statement that the Skill does not need internet ...[truncated 899 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace unconditional offline claims with precise wording such as: “Inference runs locally after dependencies and model assets have been downloaded.” 2. State prominently that installation and first use require network access. 3. Identify the expected model source, approximate download size, cache location, and applicable dependency repositories. 4. Provide an offline preparation procedure that allows administrators to pre-download and verify all required artifacts. 5. Pin the model to a reviewed immutable revision and publish trusted checksums where supported. 6. Document how users can enforce offline mode after setup and how failures are handled when the model is not cached. 7. Preserve the privacy claim only to the extent supported by the implementation, explicitly distinguishing local voice-data processing from dependency and model downloads. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill promises fully local, offline TTS/voice cloning behavior, but the documented behavior includes dependency installation from external sources and relies on a library/model workflow that is not fully represented by the stated description. This mismatch is dangerous because users and agents may trust the declared privacy/offline properties while actually performing networked installs, remote model downloads, and executing external setup scripts.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script downloads and immediately executes a remote Homebrew installer via curl and shell, which creates a supply-chain and arbitrary code execution risk at install time. In addition, this directly contradicts the skill description's 'no internet required' claim, making the behavior more suspicious because users may run it expecting a fully local setup.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The README is written entirely in Chinese while describing a general-purpose skill store package, and it does not offer an alternative language path or explain that the skill is intentionally limited to Chinese-speaking users. This creates a natural-language locale policy concern because the documentation imposes a specific language without user opt-in or clear regional justification.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents shell-capable installation and execution steps but does not declare any tool scope or permissions metadata. This creates an authorization and transparency gap: an agent or user may invoke shell actions such as running install scripts and package managers without explicit sandboxing expectations, increasing the chance of unintended command execution.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill claims it works without internet and keeps data local, yet the examples explicitly auto-download a model from a remote repository and recommend using a third-party mirror. This is a security-relevant deception/omission because it can cause users to misjudge network exposure, supply-chain risk, and privacy guarantees during setup or first execution.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

#### 1. Voice Cloning Ethics
- **Only clone voices that you own** or have **explicit written permission** to clone
- **Do not** use this skill to impersonate others without consent
- **Do not** use this skill for fraudulent, deceptive, or malicious purposes
- Respect privacy rights and obtain proper authorization for all voice data you process

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Piping curl output directly into /bin/bash executes remote code without review, integrity verification, or user confirmation. If the upstream script, transport, or repository is compromised, the installer can run arbitrary commands on the user's machine immediately.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The installation flow fetches dependencies from remote package repositories through Homebrew and pip, so the skill is not truly '无需联网' during setup. While network-based package installation is common, the misleading claim reduces informed consent and increases supply-chain exposure if users expect an entirely offline workflow.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The package metadata advertises the skill as fully local and offline, but the install script runs `brew install` and `pip install`, which fetch code and packages from external repositories during setup. This creates a supply-chain and trust-boundary issue because users may believe no network access or third-party retrieval is involved, reducing informed consent and potentially exposing them to unreviewed external dependencies.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code forces synthesized output to use `lang_code="zh"`, which is a natural-language locale constraint. The file does not provide any user opt-in, language selection, or justification that the skill is intended to be Chinese-only, so it violates the language/locale policy criteria.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The built-in TTS generation explicitly sets `language='Chinese'`, forcing a specific language choice. Because the script does not offer a language/locale choice or document a justified regional limitation, this is a natural-language policy violation.

Tainted flow: 'output' from input (line 93, user input) → open (file write)

Medium

• Category: Data Flow

Content

language='Chinese'
    ))
    
    with open(output, 'wb') as f:
        for result in results:
            f.write(result.audio)

• Confidence: 91% confidence
• Finding: The script writes to a filesystem path taken directly from interactive user input without validation or confinement. If the skill is run with elevated privileges or from a sensitive working directory, a user can overwrite arbitrary files accessible to that account, causing data loss or clobbering important files.

Scope Creep

Low

• Category: Excessive Agency

Content

#### 4. No Warranty & Limitation of Liability
```
THIS SKILL IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The user-facing title, description, and keywords are predominantly in Chinese, which can function as an implicit language restriction. The file does not state that the skill is region-specific or offer users an explicit language/locale choice, so this may conflict with a policy requiring user opt-in for language constraints.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: All user-facing comments and echoed instructions are in Chinese, with no indication that the skill is region-specific or that the user can choose another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Static analysis

No suspicious patterns detected.