EmpirioLabs AI Speech

• Outcome: Pass
• Latest audit: Oct 19, 2026 · 7:13 PM UTC
• Version: 1.0.0

Overview

This skill coherently turns user-provided text into speech through EmpirioLabs and saves the returned audio, with its API key, network use, and file output disclosed.

Install only if you are comfortable sending the text you provide to EmpirioLabs for speech generation and storing an EmpirioLabs API key in the command environment. Choose output paths deliberately, especially when using --overwrite.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (8)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/speech.py (reported line 53)May include surrounding context.

python

help="Any other model parameter, for example --param temperature=0.8. Repeatable.")
    parser.add_argument("--out", help="Output file or directory. Default: the current directory.")
    parser.add_argument("--overwrite", action="store_true",
                        help="Replace existing files instead of adding a numeric suffix.")
    parser.add_argument("--no-download", action="store_true", help="Print the hosted URL without saving the file.")
    parser.add_argument("--timeout", type=float, default=600.0,
                        help="Seconds to wait if the audio is delivered as a job (default 600).")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires sensitive capabilities—network access, environment variable access for an API key, and file writing—but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens enforcement and review because an agent may invoke the skill without a machine-readable restriction boundary, increasing the chance of overbroad access or unsafe execution in hosts that rely on declared scopes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 29)May include surrounding context.

python

__version__ = "1.0.0"

API_BASE = "https://api.empiriolabs.ai/v1"
KEY_ENV = "EMPIRIOLABS_API_KEY"
KEYS_URL = "https://platform.empiriolabs.ai/dashboard/api-keys"
BILLING_URL = "https://platform.empiriolabs.ai/dashboard/billing"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The shared request helper accepts arbitrary absolute HTTP(S) URLs, which broadens the network access surface beyond the documented API workflow. Although Authorization is only attached when the destination matches the EmpirioLabs API host, this still creates a reusable outbound HTTP client that can be abused by higher-level scripts for unintended network access, including SSRF-like behavior against attacker-chosen public or internal endpoints if user input reaches path values.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 352)May include surrounding context.

python

def list_models(timeout=60.0):
    """The public model catalog. No API key is needed."""
    payload = get_json("/models", auth=False, timeout=timeout)
    models = payload.get("data") if isinstance(payload, dict) else payload
    return models if isinstance(models, list) else []

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 360)May include surrounding context.

python

def list_models(timeout=60.0):
    """The public model catalog. No API key is needed."""
    payload = get_json("/models", auth=False, timeout=timeout)
    models = payload.get("data") if isinstance(payload, dict) else payload
    return models if isinstance(models, list) else []

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The downloader will fetch any HTTP(S) URL returned in job results and write the response to disk, not just trusted EmpirioLabs-hosted URLs. If the remote service, a compromised API response, or an attacker-controlled result URL is supplied, this can turn the skill into an arbitrary network fetcher and file dropper, potentially reaching internal services or saving unexpected content locally.

Content

No source excerpt is available for this finding.

Tainted flow: 'partial' from os.environ.get (line 689, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 691)May include surrounding context.

python

os.makedirs(folder, exist_ok=True)
                partial = path + ".part"
                try:
                    with open(partial, "wb") as handle:
                        while True:
                            chunk = resp.read(1024 * 256)
                            if not chunk:

Static analysis

No suspicious patterns detected.