Zhipu AI TTS

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:42 PM UTC
• Version: 1.0.0

Overview

This skill coherently converts Chinese text to audio through Zhipu AI, with the main user consideration being that submitted text is sent to an external API.

Install only if you are comfortable sending the text you provide, along with your Zhipu API authorization, to Zhipu AI's service for processing. Avoid submitting secrets, confidential business text, personal data, or regulated content unless that use is approved for your environment; install jq through your normal package-management process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Credential Access

High

• Category: Privilege Escalation

Content

# Configuration
API_ENDPOINT="https://open.bigmodel.cn/api/paas/v4/audio/speech"

# Get API key from environment
if [ -z "$ZHIPU_API_KEY" ]; then
    echo "Error: ZHIPU_API_KEY environment variable is not set" >&2
    echo "" >&2

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to submit arbitrary text to the TTS workflow but does not clearly disclose that the content will be transmitted to Zhipu AI's external service for processing. This creates a privacy and data-handling risk because users may unknowingly send sensitive, proprietary, or regulated text to a third party.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Install dependencies (if needed)
sudo apt-get install jq

# Set your API key
export ZHIPU_API_KEY="your-key-here"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents shell-based execution (`bash scripts/text_to_speech.sh ...`) but does not declare any `permissions` or `allowed-tools` scope. This creates an authorization gap: a host may permit shell execution without the skill explicitly constraining or disclosing that capability, increasing the chance of overbroad execution or unsafe reuse in environments with stronger tool-governance expectations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill encourages users to submit arbitrary text for TTS generation but does not clearly disclose that the text is transmitted to Zhipu AI's external service. This is a privacy and data-handling risk because users may provide sensitive, proprietary, or regulated content under the mistaken assumption that processing is local.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Voice: $VOICE, Speed: $SPEED, Format: $OUTPUT_FORMAT" >&2
echo "" >&2

RESPONSE=$(curl -s -X POST "$API_ENDPOINT" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $ZHIPU_API_KEY" \
    -d "$PAYLOAD" \

• Confidence: 97% confidence
• Finding: The curl request sends the full synthesized text and an authorization bearer token to an external API endpoint. In the context of an agent skill, this is expected functionality, but it is still a genuine external transmission boundary that can expose sensitive user content to a third party if the caller is unaware or the input is not filtered.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits user-supplied text to Zhipu's remote TTS API, but it does not clearly warn the caller that the content will leave the local environment and be sent to a third party. This creates a real privacy and data-handling risk if users provide sensitive text, credentials, personal data, or proprietary content under the assumption that processing is local.

Natural-Language Policy Violations

Low

• Confidence: 70% confidence
• Finding: The natural-language examples and service framing are entirely Chinese-specific, which can signal a locale-specific skill behavior without an explicit opt-in or justification. Under the policy, language or locale constraints should be user-selectable or clearly documented when intentionally region-specific.

Static analysis

No suspicious patterns detected.