GPT-Live Speak

• Outcome: Review
• Latest audit: Sep 20, 2026 · 8:17 PM UTC
• Version: 1.0.0

Overview

Review before installing: this is a coherent speech skill, but it silently downloads Python dependencies into a persistent cache and sends requested speech text to OpenAI for live audio generation.

Install only if you are comfortable with this skill running a bundled Python command, creating a persistent cached virtualenv, downloading OpenAI Python dependencies from PyPI, sending requested speech text to OpenAI with your OPENAI_API_KEY, and playing generated audio through ALSA. Do not use it for secrets, and consider preinstalling or reviewing dependencies and running it in an isolated account if dependency supply-chain risk matters to you.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (10)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

def main():
    ensure_runtime()

    os.execv(
        str(PYTHON),
        [
            str(PYTHON),

• Confidence: 85% confidence
• Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to invoke a Python script via an exec/shell pathway and relies on environment variables, but it does not declare any explicit tool scope such as allowed-tools or permissions. This increases the chance that the runtime may grant broader-than-necessary capabilities, making misuse or unintended command execution harder to constrain or audit.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script silently writes to the user's cache and installs packages on first run or dependency change, which is risky behavior for a skill wrapper. Even absent overt exploitation, this violates least surprise and expands the attack surface by executing package installation logic automatically, making supply-chain abuse and local environment tampering more consequential.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

    if not PYTHON.exists():
        subprocess.run(
            [
                sys.executable,
                "-m",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'VENV_DIR' from os.environ.get (line 21, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

)

    if not PYTHON.exists():
        subprocess.run(
            [
                sys.executable,
                "-m",

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)

    if installed != wanted:
        subprocess.run(
            [
                str(PYTHON),
                "-m",

• Confidence: 93% confidence
• Finding: This code automatically installs dependencies at runtime with pip into a user-writable cache-based virtual environment, without verification, pin enforcement, or user confirmation. In the skill context, that creates a meaningful supply-chain and local tampering risk: a modified requirements file, compromised package source, or preexisting malicious interpreter/environment under the cache path could lead to arbitrary code execution during installation or later use.

Tainted flow: 'PYTHON' from os.environ.get (line 24, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

)

    if installed != wanted:
        subprocess.run(
            [
                str(PYTHON),
                "-m",

• Confidence: 90% confidence
• Finding: Here the interpreter path used for pip execution is derived from a virtualenv under a cache directory influenced by XDG_CACHE_HOME. If that cache path points to attacker-controlled content, the code may execute a malicious preexisting 'python' binary or operate inside a tampered virtualenv, leading to arbitrary code execution; the auto-install behavior makes the impact worse in this embodied-agent/audio-device context because the skill may run unattended.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

try:
                event = await asyncio.wait_for(
                    connection.recv(),
                    timeout=0.1,
                )

            except asyncio.TimeoutError:

• Confidence: 75% confidence
• Finding: Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The session instructions explicitly require the model to 'Speak Italian naturally' and the file contains no user opt-in or configurable language selection in the CLI. This is a natural-language locale constraint that may violate organizational language-choice policy when applied universally.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the user-provided text to a remote network service via `connection.session.commentary.append`, but there is no confirmation prompt, print/log disclosure, or inline user-facing warning near this operation. Users invoking a local 'speak' script may not realize their text is being transmitted off-device for processing.

Static analysis

No suspicious patterns detected.