Voice.ai: Creator Voiceover Forge

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:01 PM UTC
• Version: 0.1.3

Overview

The skill mostly does what it claims, but it has review-worthy risks around redirectable API requests and unsafe generated helper scripts.

Review before installing. Use only a trusted environment and .env file, leave VOICEAI_API_BASE unset unless you fully trust the endpoint, avoid sensitive scripts unless you are comfortable sending them to Voice.ai, and do not run generated ffmpeg helper scripts for untrusted filenames or output paths.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/api.ts:291

Finding

Authenticated API requests can be redirected to an arbitrary endpoint

Content

View full analysis

''); if (res.status === 401) throw new Error('Voice.ai: Invalid or missing API key (401).'); if (res.status === 402) throw new Error('Voice.ai: Insufficient credits (402). Check your dashboard.'); if (res.status === 429) throw new Error('Voice.ai: Rate limited (429). Wait and retry.'); throw new Error(`Voice.ai TTS error ${res.status}: ${errBody}`); } return Buffer.from(await res.arrayBuffer()); ``` ### Technical Analysis The client uses `VOICEAI_API_BASE` without validating its URL scheme, hostname, port, or origin. All API paths are then constructed from this value, ...[truncated 2420 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/ffmpeg.ts:245

Finding

Command injection through generated Bash and PowerShell muxing scripts

Content

View full analysis

(a.includes(' ') ? `"${a}"` : a)).join(' ')}`; ``` Attacker-influenced paths are embedded directly into the generated Bash source and executable command: ```ts const bash = `#!/usr/bin/env bash # Replace Audio — generated by voiceai-creator-voiceover-pipeline # Sync policy: ${syncPolicy} # # Prerequisites: Install ffmpeg (https://ffmpeg.org/download.html) # macOS: brew install ffmpeg # Ubuntu: sudo apt install ffmpeg # Windows: choco install ffmpeg OR download from https://ffmpeg.org # # Usage: bash replace-audio.sh set -euo pipefail VIDEO_INPUT="${videoPath}" AUDIO_INPUT="${audioPath}" OUTPUT="${outputPath}" echo "🎬 Muxing audio into video…" echo " Video: \$VIDEO_INPUT" echo " Audio: \$AUDIO_INPUT" echo " Sync: ${syncPolicy}" echo "" ${cmdString} echo "" echo "✅ Done → \$OUTPUT" `; ``` The PowerShell generator escapes backslashes but does not escape quotes, dollar expressions, backticks, newlines, or other PowerShell syntax: ```ts const ps1 = `# Replace Audio — generated by voiceai-creator-voiceover-pipeline # Sync policy: ${syncPolicy} # # Prerequisites: Install ffmpeg (https://ffmpeg.org/download.html) # Windows: choco install ffmpeg OR winget install ffmpeg # # Usage: .\\replace-audio.ps1 $ErrorActionPreference = "Stop" $VideoInput = "${videoPath.replace(/\\/g, '\\\\')}" $AudioInput = "${audioPath.replace(/\\/g, '\\\\')}" $Output = "${outputPath.replace(/\\/g, '\\\\')}" Write-Host "🎬 Muxing au ...[truncated 3247 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a media-processing skill focused on converting scripts into publishable voiceovers using Voice.ai TTS and related publishing features. The supplied code chunk does none of that; it is only an ESLint configuration file for TypeScript projects. Its primary purpose is static analysis/tooling setup, which is materially different and unrelated to the declared functionality. This is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not implement a voiceover publishing pipeline. It is specifically a test suite for chunking-related utilities: parsing markdown headings, splitting text into segments, and generating stable hashes for segments. While segmentation could be a supporting part of the declared system, the code shown lacks any TTS calls, audio generation, captions, chapter publishing, or video muxing. Therefore the actual code chunk’s purpose is materially narrower and different from the declared end-user description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied code chunk implements only the preprocessing/chunking portion of a larger possible pipeline. It parses markdown headings, auto-chunks text, loads optional intro/outro templates from disk, and produces structured segment metadata. It does not perform the core declared functions of turning scripts into publishable voiceovers, such as synthesizing audio with Voice.ai, generating captions, or muxing video. While segmentation is consistent with part of the description, the overall declared purpose materially overstates what this code actually does. Additionally, the code reads template files from the filesystem, which is an accessed resource not reflected in the declared permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broader voiceover-production workflow centered on converting scripts into publishable voiceovers with Voice.ai TTS, plus segments, chapters, captions, and video muxing. The supplied code chunk does not do any TTS, script processing, segmentation, chaptering, or caption work. Its purpose is narrowly limited to replacing/muxing an audio file into an existing video and writing a mux report, with optional helper script generation when ffmpeg is missing. While video muxing is one part of the declared description, the actual code's primary behavior is much narrower and materially different from the declared end-to-end script-to-voiceover functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a content-production workflow centered on turning scripts into publishable voiceovers, including downstream media features like captions and video muxing. This code chunk does not perform any of those actions. Its sole purpose is to fetch and display available voices from Voice.ai. While voice selection could be a supporting part of a broader voiceover tool, this specific code chunk’s primary behavior is materially different from the declared purpose and omits the advertised generation and media-processing capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a media-production skill centered on Voice.ai text-to-speech, segmentation, chapters, captions, and video muxing. The supplied code does not implement or exercise any of those core behaviors. It is only a unit test file for low-level helper utilities such as slugify, hashing, padding, and time formatting. While SRT and YouTube timestamp formatting could be supportive pieces in a captioning pipeline, this chunk by itself is materially different in primary purpose and does not demonstrate the declared voiceover-generation functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a media-processing/TTS skill, but the supplied code only defines test runner configuration for Vitest. It does not implement or expose any Voice.ai integration, voiceover generation, captioning, chaptering, segmentation, or video muxing. This is a clear primary-purpose mismatch.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 18)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 119)May include surrounding context.

To clear cache manually:

bash

rm out/my-project/segments/.cache.json

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

md

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/cli.ts (reported line 12)May include surrounding context.

ts

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/build.ts (reported line 77)May include surrounding context.

ts

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/commands/voices.ts (reported line 29)May include surrounding context.

ts

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voiceai-vo.cjs (reported line 35)May include surrounding context.

js

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voiceai-vo.cjs (reported line 5019)May include surrounding context.

js

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voiceai-vo.cjs (reported line 5227)May include surrounding context.

js

import { replaceAudioCommand } from './commands/replace-audio.js';
import { voicesCommand } from './commands/voices.js';

// Load .env from project root
config();

const program = new Command();

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voiceai-vo.cjs (reported line 70)May include surrounding context.

js

keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · voiceai-vo.cjs (reported line 242)May include surrounding context.

js

keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to credentials and clearly describes networked Voice.ai API usage, but it does not declare an explicit tool scope such as allowed tools or permissions. In an agent setting, that omission weakens isolation and user visibility, making it easier for the skill to access environment secrets and external network resources without clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mentions privacy only under the replace-audio section and does not present a prominent warning, before use, that script contents are sent to a third-party TTS provider during normal operation. Users may unknowingly submit sensitive or proprietary scripts, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 18)May include surrounding context.

md

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · src/ffmpeg.ts (reported line 254)May include surrounding context.

ts

brew install ffmpeg

# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg

# Windows (Chocolatey)
choco install ffmpeg

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/ffmpeg.ts:49

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: voiceai-vo.cjs:112

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/api.ts:195

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: voiceai-vo.cjs:166