ClawHub
Back to skill

Security audit

Coze Tts

Security checks for vulnerabilities and agentic risk

Overview

The skill’s text-to-speech purpose is coherent, but it needs Review because it sends user text to Coze and handles the API key and output files in under-disclosed, potentially unsafe ways.

Review before installing. Use this only for text you are comfortable sending to Coze, avoid secrets or regulated data, use a narrowly scoped API key, and run it from a trusted private directory with explicit output paths. Be aware that local process monitoring may expose the API key or submitted text while the curl command runs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/text_to_speech.sh:114
Finding

Coze API bearer token exposed through process arguments

Content
View full analysis
` in its argument vector. 3. While `curl` is running, a local attacker or process-monitoring component reads its process arguments. 4. The attacker extracts the bearer token. 5. The attacker submits authenticated requests directly to the Coze API using the stolen token. Successful exploitation requires local process visibility or equivalent monitoring access during the relatively short request window. ### Impact Assessment The attacker obtains the authority associated with the exposed Coze API key. This may permit unauthorized API requests, consumption of the victim's service quota, billing impact, access to functionalit ...[truncated 235 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/text_to_speech.sh:73
Finding

Predictable output filename permits symbolic-link file clobbering

Content
View full analysis
&2 # Try to parse error from response if [ -f "$OUTPUT_FILE" ]; then ERROR_MSG=$(cat "$OUTPUT_FILE" | jq -r '.msg // .error // "Unknown error"' 2>/dev/null || echo "") if [ -n "$ERROR_MSG" ]; then echo "Error message: $ERROR_MSG" >&2 fi # Remove the error response file rm -f "$OUTPUT_FILE" fi exit 1 fi ``` ### Technical Analysis The automatic filename is predictable when an attacker knows or can infer the input text, execution time, and output format. The timestamp only has one-second granularity, and the hash is an unkeyed, truncated digest rather than a source of unpredictable randomness. `curl -o` opens the specified destination directly and follows an existing symbo ...[truncated 2011 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/text_to_speech.sh (reported line 10)May include surrounding context.

sh
# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/speech"

# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then
    echo "Error: COZE_API_KEY environment variable is not set" >&2
    echo "" >&2

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes shell scripts but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the agent runtime or user to underestimate that the skill executes shell commands, increasing the chance of unintended command execution or unsafe composition with other skills.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description and usage examples do not clearly warn users that supplied text is transmitted to the external Coze API for processing. Users may paste sensitive prompts, secrets, personal data, or regulated content without realizing it leaves the local environment, creating privacy, compliance, and data handling risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md
set -e

# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/speech"

# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/coze_tts_api.md (reported line 5)May include surrounding context.

md
set -e

# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/speech"

# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/text_to_speech.sh (reported line 8)May include surrounding context.

sh
set -e

# Configuration
API_ENDPOINT="https://api.coze.cn/v1/audio/speech"

# Get API key from environment
if [ -z "$COZE_API_KEY" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This script sends user-provided text and an API bearer token to a third-party service over the network. In a skill context, that is a genuine data exfiltration boundary: any sensitive text passed to the script leaves the local environment and is processed by Coze, which can create confidentiality and compliance risk even if the transmission is intentional for TTS functionality.

Content

Scanner excerpt · scripts/text_to_speech.sh (reported line 119)May include surrounding context.

sh
}')

# Make API request and save response
HTTP_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "$API_ENDPOINT" \
    -H "Authorization: Bearer $COZE_API_KEY" \
    -H "Content-Type: application/json" \
    -d "$JSON_PAYLOAD" \

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file presents all user-facing instructions and API documentation exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale justification or alternative language option is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The help examples use only Chinese text literals and the script targets a China-based endpoint, which may imply a fixed-language usage pattern. There is no user-facing note that other languages are supported or that language choice is optional, so this can be read as a locale preference baked into the skill.

Content

No source excerpt is available for this finding.