ClawHub
Back to skill

Security audit

文字转语音/Text to Audio

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward text-to-speech helper, with disclosed network use and dependency setup but no evidence of hidden, destructive, or credential-stealing behavior.

Install only if you are comfortable sending the text you convert, including OCR text from images, to Microsoft’s online TTS service. Run the setup in a virtual environment where possible because it may install edge-tts from PyPI into the active Python environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes local scripts, reads user-provided files/images, accesses the network, and uses shell commands, yet it declares no permissions or trust boundaries. This creates a real security issue because reviewers and runtime policy engines cannot accurately assess or constrain what the skill is allowed to do, increasing the risk of overbroad file access, unexpected command execution, or network exfiltration if the implementation is later expanded or misused.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
An environment-check script for a TTS skill should normally validate prerequisites, not mutate the host by invoking pip installs automatically. This expands the skill's capability into software installation, which can unexpectedly alter the environment, pull remote code from package repositories, and violate least-privilege expectations for a seemingly simple TTS feature.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.