Dictation Audio

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 2.0.0

Overview

This skill coherently generates English dictation audio, with ordinary dependency and temporary-file risks that users should understand before installing.

Install this only in an environment where installing an unpinned pip package and running ffmpeg/edge-tts is acceptable. Avoid using it for sensitive words on shared machines because the output is written to /tmp/dictation.mp3 and may overwrite an existing file there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-22
Vulnerability Type: Unpinned dependency version and missing integrity verification
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "package": "edge-tts",
      "label": "Install edge-tts (pip)",
    },
  ],

Technical Analysis

The installation metadata requests the edge-tts package without specifying an exact reviewed version or an expected cryptographic hash. Consequently, every new installation may resolve to a different package release. The effective dependency code can change after this Skill has been reviewed.

This creates a supply-chain risk: compromise of the package publisher, distribution account, package repository, or a future upstream release could cause malicious code to be installed. The configuration provides no lock file, hash verification, or other mechanism that would detect such a change before installation.

The issue does not demonstrate that the current edge-tts package is malicious. It means that the Skill does not constrain or verify the package artifact that it instructs the environment to install.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious release under the expected edge-tts package name.
3. A user or automated Skill installer processes this metadata and resolves the unpinned package to the malicious release.
4. The malicious package is installed with the permissions of the account performing installation.
5. Attacker-controlled code may execute through package installation behavior or later when dictation.py invokes the installed edge-tts executable.

Impact Assessment

Successful exploitation could execute attacker-controlled code with the privileges of the installing or runtime user. Depending on ...[truncated 403 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin edge-tts to an exact version that has been reviewed, for example by using an exact-version requirement rather than an unconstrained package name.
2. Record and verify cryptographic hashes for the package and all transitive dependencies. Use a hash-locked requirements file and install with pip's --require-hashes option where supported.
3. Generate dependency locks in a controlled build process and commit the lock data with the Skill.
4. Retrieve packages only from an explicitly configured trusted repository or an internally controlled package mirror.
5. Run dependency installation and audio generation as a non-privileged user in an isolated environment.
6. Periodically review and update the pinned version after checking release provenance, dependency changes, and known vulnerabilities.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares executable capabilities that imply shell execution and file writing, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a trust and containment gap: reviewers and runtime policy engines cannot easily constrain what the skill is allowed to do, increasing the chance of unintended command execution or filesystem modification beyond the expected behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description states the skill generates dictation audio specifically from English words, which imposes a language constraint. The file does not offer a language choice or explain that this is a justified region- or compliance-specific limitation, so it fits the locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module description states the skill is an '英语单词听写音频生成器' and is specifically for generating dictation audio for English words. This natural-language constraint imposes a language-specific behavior without indicating any user choice or opt-in for language/locale, which matches the policy-violation category for forced language selection.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · dictation.py (reported line 48)May include surrounding context.

python

"--text", word,
        "--write-media", output_path
    ]
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · dictation.py (reported line 74)May include surrounding context.

python

"-q:a", "9",
        output_path
    ]
    result = subprocess.run(cmd, capture_output=True, timeout=10)
    return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 86% confidence

Finding

The ffmpeg concat step consumes a list file containing file paths and explicitly enables '-safe 0', which disables ffmpeg's path safety checks. In this specific code, the listed paths are internally generated in a temporary directory, so the immediate exploitability is limited, but using unsafe concat mode increases risk if file list contents or tempdir behavior ever become attacker-influenced, and ffmpeg has historically had a meaningful attack surface around media parsing.

Content

Scanner excerpt · dictation.py (reported line 103)May include surrounding context.

python

"-c", "copy",
            output_path
        ]
        result = subprocess.run(cmd, capture_output=True, timeout=60)
        return result.returncode == 0
    finally:
        if os.path.exists(list_file):

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code writes the final output to a predictable world-accessible path, '/tmp/dictation.mp3', despite claiming all paths are temporary. Predictable files in /tmp can be vulnerable to symlink or clobbering issues in multi-user environments, potentially overwriting other files accessible to the process or exposing generated content to other local users.

Content

No source excerpt is available for this finding.