06 Tts Voice

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.3

Overview

This is a straightforward text-to-speech skill, but users should only configure it with a trusted HTTPS TTS provider because dialogue text and the API key are sent to that endpoint.

Install only if you are comfortable sending the dialogue text to the configured TTS provider. Configure API_BASE to a trusted HTTPS endpoint, use a scoped API key with limited quota, avoid submitting confidential or regulated dialogue unless the provider is approved for it, and prefer a version that documents the external processor and validates the endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.js:3

Finding

Unrestricted TTS Endpoint May Expose Dialogue and API Credentials

Content

View full analysis

Vulnerability Details

File Location: skill.js, lines 3–16
Vulnerability Type: Unvalidated external endpoint and sensitive-data transmission
Risk Level: Medium

Vulnerable Code

js

const { dialogue } = inputs;

const API_KEY = env.API_KEY;
const API_BASE = env.API_BASE;
const MODEL_NAME = env.MODEL_NAME;

const res = await fetch(`${API_BASE}/tts`, {
  method: "POST",
  headers: {
    "Authorization": "Bearer " + API_KEY,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    model: MODEL_NAME,
    text: dialogue
  })
});

Technical Analysis

The Skill sends the user-provided dialogue and an API key to a URL constructed directly from the environment-controlled API_BASE value. It does not parse or validate the URL, enforce HTTPS, restrict the destination hostname, reject embedded credentials, or limit the destination port.

Sending dialogue to an external service is necessary for the declared remote TTS functionality. However, allowing an unrestricted destination exceeds the minimum safe network scope. A malicious or compromised configuration can redirect the request to an attacker-controlled endpoint. If an http:// URL is accepted, the bearer credential and dialogue can also traverse the network without transport encryption.

Attack Path

1. An attacker compromises deployment configuration or otherwise gains influence over API_BASE.
2. The attacker changes API_BASE to an attacker-controlled server or a plaintext HTTP endpoint.
3. A user invokes the Skill with dialogue that may contain confidential content.
4. The Skill sends the dialogue in the JSON request body and API_KEY in the Authorization header to the configured endpoint.
5. The attacker captures the dialogue and bearer credential and may reuse the credential within the permissions granted by the TTS provider.

Impact Assessment

Successful exploitation can disclose user dial ...[truncated 598 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse API_BASE with new URL() and reject malformed values.
2. Require the https: protocol; reject plaintext HTTP and all unexpected schemes.
3. Enforce an explicit allowlist of approved TTS provider hostnames rather than accepting arbitrary destinations.
4. Reject embedded URL credentials, unexpected ports, and hosts resolving to loopback, link-local, or private network ranges unless such access is explicitly required.
5. Use a provider-specific, least-privileged API key with restricted capabilities and quotas, and rotate it if exposure is suspected.
6. Document clearly that dialogue is transmitted to an external TTS provider and may be subject to that provider's retention and privacy policies.
7. Validate required environment values at startup and fail closed when endpoint validation fails.
8. Avoid logging the authorization header, API key, dialogue, or full request payload.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file presents all user-facing instructions and parameters exclusively in Chinese, which can amount to a language policy violation when no user opt-in or alternative language support is mentioned. There is also no indication that this skill is intended only for a China-specific or Chinese-only compliance context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends raw user dialogue to an external text-to-speech endpoint along with use of a bearer API credential, but provides no indication of consent, disclosure, or minimization. This creates a privacy and data-governance risk because sensitive user content may be transmitted off-platform unexpectedly, especially if dialogue can contain personal, confidential, or regulated information.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest only provides the short description "台词生成配音" without specifying concrete trigger phrases, activation boundaries, or exclusion conditions. In a manifest file, this kind of broad description can make it unclear when the skill should be invoked versus when other writing, dialogue, or audio-related skills should apply.

Content

No source excerpt is available for this finding.