Dictation Audio

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 2.0.0

Overview

This skill coherently generates English dictation audio, with ordinary dependency and temporary-file risks that users should understand before installing.

Install this only in an environment where installing an unpinned pip package and running ffmpeg/edge-tts is acceptable. Avoid using it for sensitive words on shared machines because the output is written to /tmp/dictation.mp3 and may overwrite an existing file there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Unpinned Third-Party Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 17-22 **Vulnerability Type**: Unpinned dependency version and missing integrity verification **Risk Level**: Medium ### Vulnerable Code ```yaml "install": [ { "id": "pip", "kind": "pip", "package": "edge-tts", "label": "Install edge-tts (pip)", }, ], ``` ### Technical Analysis The installation metadata requests the `edge-tts` package without specifying an exact reviewed version or an expected cryptographic hash. Consequently, every new installation may resolve to a different package release. The effective dependency code can change after this Skill has been reviewed. This creates a supply-chain risk: compromise of the package publisher, distribution account, package repository, or a future upstream release could cause malicious code to be installed. The configuration provides no lock file, hash verification, or other mechanism that would detect such a change before installation. The issue does not demonstrate that the current `edge-tts` package is malicious. It means that the Skill does not constrain or verify the package artifact that it instructs the environment to install. ### Attack Path 1. An attacker compromises the upstream package, its publisher account, or the package distribution channel. 2. The attacker publishes a malicious release under the expected `edge-tts` package name. 3. A user or automated Skill installer processes this metadata and resolves the unpinned package to the malicious release. 4. The malicious package is installed with the permissions of the account performing installation. 5. Attacker-controlled code may execute through package installation behavior or later when `dictation.py` invokes the installed `edge-tts` executable. ### Impact Assessment Successful exploitation could execute attacker-controlled code with the privileges of the installing or runtime user. Depending on ...[truncated 403 chars]
• Remediation: ## Remediation Suggestions 1. Pin `edge-tts` to an exact version that has been reviewed, for example by using an exact-version requirement rather than an unconstrained package name. 2. Record and verify cryptographic hashes for the package and all transitive dependencies. Use a hash-locked requirements file and install with pip's `--require-hashes` option where supported. 3. Generate dependency locks in a controlled build process and commit the lock data with the Skill. 4. Retrieve packages only from an explicitly configured trusted repository or an internally controlled package mirror. 5. Run dependency installation and audio generation as a non-privileged user in an isolated environment. 6. Periodically review and update the pinned version after checking release provenance, dependency changes, and known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares executable capabilities that imply shell execution and file writing, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: reviewers and runtime policy engines cannot easily constrain what the skill is allowed to do, increasing the chance of unintended command execution or filesystem modification beyond the expected behavior.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The description states the skill generates dictation audio specifically from English words, which imposes a language constraint. The file does not offer a language choice or explain that this is a justified region- or compliance-specific limitation, so it fits the locale/language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The module description states the skill is an '英语单词听写音频生成器' and is specifically for generating dictation audio for English words. This natural-language constraint imposes a language-specific behavior without indicating any user choice or opt-in for language/locale, which matches the policy-violation category for forced language selection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--text", word,
        "--write-media", output_path
    ]
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-q:a", "9",
        output_path
    ]
    result = subprocess.run(cmd, capture_output=True, timeout=10)
    return result.returncode == 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-c", "copy",
            output_path
        ]
        result = subprocess.run(cmd, capture_output=True, timeout=60)
        return result.returncode == 0
    finally:
        if os.path.exists(list_file):

• Confidence: 86% confidence
• Finding: The ffmpeg concat step consumes a list file containing file paths and explicitly enables '-safe 0', which disables ffmpeg's path safety checks. In this specific code, the listed paths are internally generated in a temporary directory, so the immediate exploitability is limited, but using unsafe concat mode increases risk if file list contents or tempdir behavior ever become attacker-influenced, and ffmpeg has historically had a meaningful attack surface around media parsing.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The code writes the final output to a predictable world-accessible path, '/tmp/dictation.mp3', despite claiming all paths are temporary. Predictable files in /tmp can be vulnerable to symlink or clobbering issues in multi-user environments, potentially overwriting other files accessible to the process or exposing generated content to other local users.

Static analysis

No suspicious patterns detected.