Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: this is a coherent speech skill, but it silently downloads Python dependencies into a persistent cache and sends requested speech text to OpenAI for live audio generation.
Install only if you are comfortable with this skill running a bundled Python command, creating a persistent cached virtualenv, downloading OpenAI Python dependencies from PyPI, sending requested speech text to OpenAI with your OPENAI_API_KEY, and playing generated audio through ALSA. Do not use it for secrets, and consider preinstalling or reviewing dependencies and running it in an isolated account if dependency supply-chain risk matters to you.
os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
def main():
ensure_runtime()
os.execv(
str(PYTHON),
[
str(PYTHON),
The skill instructs the agent to invoke a Python script via an exec/shell pathway and relies on environment variables, but it does not declare any explicit tool scope such as allowed-tools or permissions. This increases the chance that the runtime may grant broader-than-necessary capabilities, making misuse or unintended command execution harder to constrain or audit.
The script silently writes to the user's cache and installs packages on first run or dependency change, which is risky behavior for a skill wrapper. Even absent overt exploitation, this violates least surprise and expands the attack surface by executing package installation logic automatically, making supply-chain abuse and local environment tampering more consequential.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
)
if not PYTHON.exists():
subprocess.run(
[
sys.executable,
"-m",
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
)
if not PYTHON.exists():
subprocess.run(
[
sys.executable,
"-m",
This code automatically installs dependencies at runtime with pip into a user-writable cache-based virtual environment, without verification, pin enforcement, or user confirmation. In the skill context, that creates a meaningful supply-chain and local tampering risk: a modified requirements file, compromised package source, or preexisting malicious interpreter/environment under the cache path could lead to arbitrary code execution during installation or later use.
)
if installed != wanted:
subprocess.run(
[
str(PYTHON),
"-m",
Here the interpreter path used for pip execution is derived from a virtualenv under a cache directory influenced by XDG_CACHE_HOME. If that cache path points to attacker-controlled content, the code may execute a malicious preexisting 'python' binary or operate inside a tampered virtualenv, leading to arbitrary code execution; the auto-install behavior makes the impact worse in this embodied-agent/audio-device context because the skill may run unattended.
)
if installed != wanted:
subprocess.run(
[
str(PYTHON),
"-m",
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
try:
event = await asyncio.wait_for(
connection.recv(),
timeout=0.1,
)
except asyncio.TimeoutError:
The session instructions explicitly require the model to 'Speak Italian naturally' and the file contains no user opt-in or configurable language selection in the CLI. This is a natural-language locale constraint that may violate organizational language-choice policy when applied universally.
The script sends the user-provided text to a remote network service via connection.session.commentary.append, but there is no confirmation prompt, print/log disclosure, or inline user-facing warning near this operation. Users invoking a local 'speak' script may not realize their text is being transmitted off-device for processing.