ClawHub
Back to skill

Security audit

Tts Router

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local text-to-speech helper, but it also enables voice cloning from online media without consent safeguards and uses unpinned executable package installs.

Review before installing. Use this only in an isolated environment with versions pinned where possible, avoid arbitrary online media URLs, and clone voices only when you have clear authorization from the speaker. Expect local model caches and optional OpenClaw configuration changes, but I did not find hidden persistence or credential access in the skill artifacts.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Package Installation and Immediate Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–24
Vulnerability Type: Unpinned and unverifiable third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
# From PyPI (requires --prerelease=allow due to mlx-audio upstream dep)
uvx --prerelease=allow tts-router list

# Or install with pip
pip install tts-router

Technical Analysis

The documented installation commands resolve tts-router and its transitive dependencies from PyPI without specifying an exact version, integrity hash, lockfile, or verified source revision.

The uvx command does not merely download the package: it immediately runs the resolved tts-router executable. The --prerelease=allow option also permits prerelease dependency versions, increasing the range of remotely supplied components that may be selected.

This repository contains documentation only and does not include the source code of tts-router or its dependencies. Consequently, the behavior of the code installed and executed by these instructions cannot be verified from the audited artifact. This creates supply-chain exposure if the package, a transitive dependency, its publisher account, or the package-resolution process is compromised.

Attack Path

  1. An attacker compromises the tts-router distribution, a transitive dependency, or an associated package-publishing account.
  2. The attacker publishes a malicious version that remains compatible with the unpinned requirement.
  3. A user or agent follows the documented uvx --prerelease=allow tts-router list instruction.
  4. The package manager resolves and downloads the attacker-controlled release.
  5. uvx immediately executes the downloaded package under the invoking user's account.
  6. The malicious code can perform actions available to that account before or instead of displaying the expected model list.

The alternative pip install tts-router instruction creates the same unpinned dependency risk, although subsequ ...[truncated 806 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin tts-router to a specific, reviewed version rather than resolving the latest available release:

    bash
    uvx --from 'tts-router==X.Y.Z' tts-router list

    or:

    bash
    pip install 'tts-router==X.Y.Z'

  2. Publish cryptographic hashes for the package and all resolved dependencies, and enforce hash verification during installation.

  3. Provide a committed lockfile or equivalent reproducible dependency manifest that records exact transitive dependency versions.

  4. Avoid --prerelease=allow unless a specific reviewed prerelease dependency is unavoidable. Pin that dependency explicitly and document why it is required.

  5. Link to the authoritative source repository and a specific reviewed release or commit so users can verify package provenance.

  6. Recommend installation and initial execution inside an isolated, least-privileged environment without sensitive credentials or unnecessary filesystem access.

  7. Add release-signing or provenance verification instructions where supported by the package distribution workflow.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation explicitly promotes cloning a voice from arbitrary URLs and uploading/fetching reference audio, but provides no warning about consent, copyright, privacy, biometric voice data handling, or impersonation abuse. Because voice data is sensitive and the feature is framed as easy to use from external sources, the surrounding context makes the omission materially more dangerous rather than merely incomplete documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document teaches voice cloning without any warning about consent, impersonation, privacy, or misuse risks. For a skill whose core function is reproducing a person's voice, omission of these safeguards makes harmful misuse substantially easier and normalizes cloning from third-party audio as routine behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advertises activation for broad phrases like 'generate speech' and especially sensitive requests such as 'clone a voice' or 'speak in someone's voice' without any gating around consent, impersonation, or user intent. In an agent ecosystem, overly broad routing can cause this capability to activate in ambiguous contexts and facilitate misuse of voice-cloning features that carry impersonation and privacy risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
tts-router serve

# 3. Generate speech (OpenAI format)
curl -X POST http://localhost:8091/v1/audio/speech \
  -H "Content-Type: application/json" \
  -d '{"input": "Hello world", "voice": "Vivian"}' \
  --output output.wav

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/voice-cloning.md (reported line 19)May include surrounding context.

bash
# Register the reference audio by URL
curl -X POST http://localhost:8091/v1/audio/references/from-url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/speaker.mp3", "ref_id": "my-speaker"}' \
  | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/voice-cloning.md (reported line 44)May include surrounding context.

bash
# Register the reference audio by URL
curl -X POST http://localhost:8091/v1/audio/references/from-url \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/speaker.mp3", "ref_id": "my-speaker"}' \
  | jq .

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/voice-cloning.md (reported line 25)May include surrounding context.

md
| jq .

# Clone the voice
curl -X POST http://localhost:8091/v1/audio/clone \
  -H "Content-Type: application/json" \
  -d '{"input": "Text to speak in this voice", "ref_id": "my-speaker"}' \
  --output cloned.wav

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide expands a local TTS tool into remote acquisition of reference audio from arbitrary URLs and streaming sites, which broadens the capability from local synthesis to network retrieval and ingestion of third-party content. In the context of voice cloning, this materially increases abuse potential because it lowers the friction for cloning voices from online media without the speaker's knowledge or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instructions state that the server will automatically download and process streaming-site audio, but do not warn users that external network retrieval and third-party content handling are occurring. This can surprise users, obscure provenance and legal/privacy implications, and facilitate unauthorized ingestion of content for cloning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Bundling yt-dlp gives the skill a generalized media extraction capability far beyond normal local TTS operation. Combined with cloning, this enables easy harvesting of voices from many platforms, increasing privacy, impersonation, and content-handling risk while also introducing broader network-facing behavior not justified by the narrow skill purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/voice-cloning.md (reported line 50)May include surrounding context.

md
| jq .

# Then generate speech
curl -X POST http://localhost:8091/v1/audio/clone \
  -H "Content-Type: application/json" \
  -d '{"input": "这段话会用视频里的声音来朗读", "ref_id": "bili-speaker"}' \
  --output cloned.wav

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/voice-cloning.md (reported line 64)May include surrounding context.

md
| jq .

# Then generate speech
curl -X POST http://localhost:8091/v1/audio/clone \
  -H "Content-Type: application/json" \
  -d '{"input": "这段话会用视频里的声音来朗读", "ref_id": "bili-speaker"}' \
  --output cloned.wav

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The sample clone request hard-codes Chinese text as the generated output without any indication that language choice is optional or region-specific. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in or justification.

Content

No source excerpt is available for this finding.