ClawHub
Back to skill

Security audit

Qclaw Speaker

Security checks for vulnerabilities and agentic risk

Overview

This TTS skill is broadly aligned with its purpose, but its installer and runtime take high-impact actions without enough containment or integrity checks.

Review before installing. Use an isolated virtual environment, do not run the installer as administrator, prefer offline engines for sensitive text, and avoid enabling auto-speak in shared or confidential settings. The main risks are not hidden malware in the inspected text, but unsafe installation practices, unverified model downloads, cloud TTS privacy, and mutation of installed Python package files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.py:112
Finding

Unverified Remote Model Archives Are Downloaded and Later Loaded by the TTS Runtime

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install.py:127
Finding

Unsafe Tar Extraction Permits Filesystem Traversal and Arbitrary File Overwrite

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/install.py:45
Finding

Unpinned Package Installation Executes Mutable Third-Party Installation Code

Content
View full analysis
Remediation
View remediation

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/install.py:61
Finding

Runtime Replaces Native DLLs Inside Third-Party Package Directories

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Ae5

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Instruction-capable artifact exceeds whole-file semantic analysis limits

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README recommends Edge TTS as the default/high-quality engine without clearly disclosing that input text may be sent to a remote provider for synthesis. Because this skill is specifically designed to read AI outputs automatically, users may unknowingly route sensitive prompts, personal data, or confidential model responses to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README promotes automatic voice playback and automatic sending of audio messages after AI replies, but it does not warn users that generated content may be spoken aloud or transmitted in contexts where bystanders, recipients, or external services can access it. In a TTS/integration skill, this creates a real privacy and safety risk because sensitive model outputs could be disclosed unintentionally through speakers or forwarded audio messages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises and instructs use of scripts that can install packages, write configuration, access the network, and invoke shell commands, yet it declares no explicit tool scope or permission boundaries. That mismatch can lead an agent platform to grant broader-than-expected capabilities or prevent users from understanding that installation and cloud-backed TTS operations may occur.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include very common words like “说话”, “开口”, “读出来”, and “tts”, which are likely to appear in ordinary conversation unrelated to explicitly invoking this skill. In an agent environment, this can cause unintended activation, leading to surprise audio output, configuration changes such as auto-speak, or unintended network-backed TTS requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation states that Edge TTS is online and that data goes to the cloud, but it does not present a clear, front-loaded user warning or consent step before this engine is used as the preferred default. Because this skill is designed to read arbitrary model output aloud, sensitive text could be transmitted to a third party without the user realizing the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code runs pip installs and later writes files under the skill directory, which are safety-relevant system modifications. While it prints progress messages, there is no user-facing warning or explanatory comment disclosing that running the installer will change the Python environment and local files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install.py (reported line 47)May include surrounding context.

python
def pip_install(pkg: str):
    print(f"  pip install {pkg}...", end=" ", flush=True)
    r = subprocess.run([sys.executable, "-m", "pip", "install", pkg, "-q"],
                       capture_output=True, text=True, timeout=120)
    print("✅" if r.returncode == 0 else f"❌ {r.stderr.strip()[-80:]}")
    return r.returncode == 0

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/install.py (reported line 56)May include surrounding context.

python
def check_engine(name: str) -> bool:
    checks = {"edge": "edge_tts", "win": "pyttsx3", "sherpa": "sherpa_onnx"}
    try:
        __import__(checks.get(name, name))
        return True
    except ImportError:
        return False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script downloads a remote tar.bz2 archive and extracts it with tarfile.extractall() without validating member paths or verifying integrity. A malicious or compromised mirror/release asset could use path traversal entries to overwrite arbitrary files on the host, and the skill context increases risk because model downloads are a normal expected action users may trust.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language description and examples present the tool as a Chinese-only TTS system, and the registered voices are all Chinese voices. There is no visible user opt-in or documented rationale for forcing a specific language/locale, which matches the language-policy violation category.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Edge TTS path transmits the provided text to Microsoft's online TTS service via edge_tts.Communicate(...).save(...) without an explicit warning, consent prompt, or operation-site indication that input may leave the local machine. In a voice-broadcast skill, users may submit sensitive content expecting local synthesis, so this can cause unintended disclosure of private data to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The config hard-codes the voice to "xiaoxiao", which appears to select a specific language or locale variant without indicating that the user can choose an alternative. The policy requires avoiding forced language or locale settings unless there is explicit opt-in or a documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This manifest/config hard-codes the language and region to Simplified Chinese for China through the language fields and Chinese eSpeak voice. Under the policy, forcing a specific language or locale without user choice or an explicit documented justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file header and user-facing strings present the installer as a Chinese-only experience, including Chinese usage examples, without indicating that language is selectable or that the skill is intentionally region-specific. This can violate a language/locale policy when users are not given opt-in or alternatives.

Content

No source excerpt is available for this finding.