ClawHub
Back to skill

Security audit

MLX TTS

Security checks for vulnerabilities and agentic risk

Overview

This local text-to-speech skill appears purpose-aligned, but its installer can modify the host environment and force-install an unpinned prerelease-capable dependency.

Review the installer before use. It may install Homebrew packages and force-install the current prerelease-capable mlx-audio package rather than a pinned reviewed version; prefer pinning or manual installation if you need a controlled environment. Also be aware that broad phrases like "Say ..." can invoke the skill and create/send an audio file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.sh:5
Finding

Unpinned Prerelease Dependency Is Force-Installed

Content
View full analysis

Vulnerability Details

File Location: install.sh, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
uv tool install --force "mlx-audio" --prerelease=allow

Technical Analysis

The installation script retrieves mlx-audio without specifying an exact version or enforcing package integrity through a lockfile or cryptographic hashes. The --prerelease=allow option permits unstable prerelease versions to satisfy dependency resolution, while --force replaces an existing installation.

Consequently, the installed executable may differ from the version evaluated during this audit. If the upstream package, maintainer account, package registry, or dependency resolution chain is compromised, a malicious release could be selected and installed. This is a supply-chain weakness rather than evidence that the current upstream package is malicious.

Attack Path

  1. An attacker compromises the upstream package, its publisher account, or a dependency used by mlx-audio, and publishes a malicious version that satisfies the unconstrained requirement.
  2. A user executes install.sh.
  3. uv resolves the mutable package requirement and may select the attacker-controlled release, including a prerelease because --prerelease=allow is enabled.
  4. The --force option replaces any existing installation with the newly resolved package.
  5. Malicious package installation behavior or subsequent execution through mlx_audio.tts.generate runs under the installing user's account.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running the installer or invoking the installed TTS tool. This could expose files, credentials, environment variables, and other resources accessible to that user, modify user-owned data, or install additional malicious components. No privilege-escalation mechanism is present in the audit ...[truncated 87 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin mlx-audio to an exact, reviewed version rather than allowing unconstrained resolution:
    bash
    uv tool install "mlx-audio==<audited-version>"
  2. Do not enable prerelease resolution unless a specific, reviewed prerelease is strictly required.
  3. Remove --force by default so an existing trusted installation is not silently replaced. If replacement is necessary, require an explicit upgrade action.
  4. Maintain a lockfile or equivalent dependency manifest that fixes transitive dependency versions.
  5. Enforce package hashes or another integrity-verification mechanism where supported.
  6. Review and test dependency updates before changing pinned versions, and document the approved package source and version.
  7. Run installation and TTS generation under a least-privileged user without access to unrelated secrets or sensitive files.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad natural-language patterns like "Say ", "TTS ...", and "Reply with voice message ...", which can match ordinary conversation and cause the skill to activate unexpectedly. In a skill that executes local scripts and produces files, accidental activation increases the chance of unintended command execution, resource use, or sending an audio file when the user did not explicitly invoke this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The install script automatically installs system packages and a Python-based tool without any user warning, prompt, or explicit consent. Even though this appears intended to simplify setup for a local TTS skill, silently modifying the host environment can surprise users, pull unpinned third-party code, and increase supply-chain risk if a package source is compromised or behaves unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script invokes ffmpeg with the -y flag, which suppresses overwrite prompts, and performs audio file generation/conversion without any confirmation prompt, comment, or user-facing notice. Although shell execution is central to the script's purpose, there is no visible disclosure that files will be created in a temporary directory and an existing target would be overwritten if paths changed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.