Voice.ai Voices

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 1.1.5
• Hash: 2ba80d80355f5208644b4654dc6c513729a2672ace877ac5042807527f0fe177
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is generally well-documented and transparent, explicitly stating its network and file access behaviors. However, the `scripts/tts.js` file directly uses the user-provided `--output` argument for `fs.writeFileSync` and `fs.createWriteStream` without path sanitization. This introduces a path traversal vulnerability, allowing an attacker to write generated audio to arbitrary file paths (e.g., `../../../../etc/passwd`), potentially leading to data corruption or denial-of-service, which is a risky capability without clear malicious intent.