Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward text-to-speech helper that sends user-provided text to a configured Kokoro API and saves the resulting audio file.
Install only if you trust the Kokoro API endpoint configured in KOKORO_API_URL. Keep the default localhost endpoint for private text, and avoid speaking secrets or sensitive personal content through a remote server unless you trust that server.
The skill advertises behavior that depends on environment configuration and network access, but the manifest does not declare any tool scope or permissions boundary. This can lead to overbroad execution in hosts that rely on manifest-declared capabilities for review, making data egress and environment use less visible to users and operators.
The manifest description says to use the skill when the user asks to "say" something, requests a voice message, or wants text converted to speech. Phrases like "say something" and "voice message" are broad everyday language and the file does not provide exclusions or negative examples to narrow when the skill should or should not activate.
The documentation states that supplied text may be sent to a local or remote TTS API but does not warn users about possible data transmission to external infrastructure. If sensitive prompts, names, or message content are spoken, this creates a privacy and data-handling risk, especially when the endpoint is remote and configurable.
The skill description claims a local Kokoro TTS engine, but the implementation sends the full text to a configurable HTTP endpoint via KOKORO_API_URL. That mismatch creates a data-flow surprise: users may believe text stays local when it can instead be transmitted to another service, including a non-local endpoint if the environment is modified.
Allowing the destination URL to be fully controlled by an environment variable enables silent exfiltration of all spoken text to an arbitrary endpoint. In an agent setting, users may provide sensitive content for speech generation, so this exceeds the stated TTS purpose and turns the skill into a flexible data-forwarding mechanism.
The code transmits raw user text to a TTS API without any user-facing disclosure that their prompt content is being sent to another service. Even if the service is intended to be local, the lack of transparency is risky because the endpoint is configurable and the text may contain secrets, personal data, or private messages.
The manifest describes the engine as local, but the documentation allows a configurable remote endpoint via KOKORO_API_URL. This mismatch can mislead reviewers or users into assuming text never leaves the machine when it may be transmitted to a remote service.
The script writes generated audio to a media/ directory using fs.writeFileSync, affecting the user's filesystem. While the final console output reveals the resulting path, it does not clearly warn beforehand that a new file will be created on disk.
Detected: suspicious.env_credential_access
