TTS WhatsApp

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:08 AM UTC
• Version: 1.0.0

Overview

The skill matches its WhatsApp voice-message purpose, but installation depends on unreviewed, changeable external code and models before it can send messages.

Review this skill before installing. It is not proven malicious, but the package does not include the runnable implementation, and the documented install process pulls changeable external code and models. Use pinned releases and checksums where possible, test with --no-send first, avoid sensitive text, and be careful with default recipients and group targets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALL.md:62

Finding

Unpinned and Unverified Third-Party Components

Content

View full analysis

Remediation

View remediation

``` Verify the commit or release signature before copying any files. 3. Replace `git pull` upgrades with explicit, versioned releases. Document the expected release tag, commit identifier, and signature verification procedure. 4. Pin Hugging Face downloads to immutable revision identifiers rather than `main`. 5. Publish SHA-256 checksums or signed checksum manifests for every `.onnx` and `.onnx.json` file. Verify each file before it is parsed: ```bash sha256sum -c piper-models.sha256 ``` 6. Include the actual skill implementation, executable scripts, and dependency manifest in the distributed artifact so reviewers can audit the code that users will execute. 7. Generate and publish an SBOM and provenance metadata for releases. Use automated dependency scanning and reproducible release procedures. 8. Run TTS processing and media conversion with least privilege, restricted filesystem access, and no unnecessary access to messaging credentials or unrelated user data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · INSTALL.md (reported line 33)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Fedora/RHEL
sudo dnf install ffmpeg

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 252)May include surrounding context.

bash

# Remove the skill
rm -rf ~/.clawdbot/skills/tts-whatsapp

# Optionally remove voice models
rm -rf ~/.clawdbot/skills/piper-tts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 255)May include surrounding context.

bash

# Remove the skill
rm -rf ~/.clawdbot/skills/tts-whatsapp

# Optionally remove voice models
rm -rf ~/.clawdbot/skills/piper-tts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 252)May include surrounding context.

bash

# Remove the skill
rm -rf ~/.clawdbot/skills/tts-whatsapp

# Optionally remove voice models
rm -rf ~/.clawdbot/skills/piper-tts

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 255)May include surrounding context.

md

rm -rf ~/.clawdbot/skills/tts-whatsapp

# Optionally remove voice models
rm -rf ~/.clawdbot/skills/piper-tts

# Optionally uninstall Piper
pip3 uninstall piper-tts

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file announces behaviors that can affect user data and system state: automatic WhatsApp delivery and auto-deletion/cleanup of generated files. Under the markdown-specific warning rule, the description should explicitly warn users about message transmission to external services and file removal, but the text presents them as features without any cautionary notice.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 33)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Fedora/RHEL
sudo dnf install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 36)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Fedora/RHEL
sudo dnf install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 39)May include surrounding context.

md

brew install ffmpeg

# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg

# Fedora/RHEL
sudo dnf install ffmpeg

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 64)May include surrounding context.

rm -rf temp

Or download and extract manually

mkdir -p ~/.clawdbot/skills/tts-whatsapp cd ~/.clawdbot/skills/tts-whatsapp

Extract downloaded files here

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The guide encourages users to configure a default WhatsApp target and then run live test commands, but it does not clearly warn that these tests will send a real outbound voice message. In a messaging skill, that omission can cause unintended delivery to a personal or third-party recipient, creating privacy, cost, and accidental-notification risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The uninstall section includes recursive deletion commands using rm -rf without an explicit warning that the action is irreversible. Even though the paths are scoped to the user's home directory, destructive shell commands in documentation can still lead to accidental data loss if copied blindly or modified incorrectly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · LANGUAGES.md (reported line 194)May include surrounding context.

Example Downloads

bash

# Create models directory
mkdir -p ~/.clawdbot/skills/piper-tts/models/

# Download French model

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README repeatedly promotes automatic WhatsApp delivery of generated speech but does not clearly warn that the provided text and recipient metadata will be transmitted to an external messaging platform. In a messaging skill, that omission can cause users to unknowingly send sensitive or regulated content off-host, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises automatic WhatsApp delivery to individuals and groups but does not prominently warn users that provided text may be immediately transmitted to external recipients. In a messaging skill, especially one supporting group IDs and default targets, this omission increases the risk of accidental disclosure, spam, or unintended mass messaging when users assume the action is only local TTS generation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation advertises smart cleanup and auto-delete behavior, but it does not prominently warn users that generated audio files may be removed automatically after successful delivery. This can lead to unexpected loss of artifacts that users expected to retain for auditing, verification, or reuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The README includes troubleshooting output in French ('Modèle introuvable', 'Aucun destinataire défini') even though the skill is presented as multi-language and primarily documented in English. This can conflict with language/locale policy expectations when a specific language is imposed without opt-in or explanation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.