ClawHub
Back to skill

Security audit

SAM TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SAM text-to-speech helper that installs one npm dependency, writes generated audio files, and stores a small user-controlled mode setting.

Before installing, understand that enabling /sam mode tells the agent to persist a small setting and turn future responses into generated WAV audio until turned off. Review dependency updates normally, since package.json uses a version range even though the current lockfile is pinned.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The core behavior matches SAM-based speech generation with configurable pitch, speed, mouth, and throat parameters. However, the declared description presents this as a chat skill for a /sam command with a persistent on/off mode affecting all responses, while the supplied code is only a standalone command-line WAV generator. It does not implement triggers, command routing, toggle state, or any mechanism to speak all responses. The code also includes phonetic input support not described. This is a meaningful description-versus-behavior mismatch in primary integration and advertised capabilities.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dependency uses a caret range (^0.3.0), which allows installation of newer compatible releases rather than a single exact version. This can introduce supply-chain risk because future upstream package changes could be pulled in without explicit review, though in this file the risk is limited to a single small dependency and there is no additional suspicious context.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"test": "node scripts/sam-tts-wrapper.js 'Testing SAM TTS' --output=/tmp/sam-test.wav --quiet"
  },
  "dependencies": {
    "sam-js": "^0.3.0"
  },
  "keywords": ["tts", "sam", "voice", "openclaw", "skill"],
  "license": "MIT"

Static analysis

No suspicious patterns detected.