chichi-speech (local text-to-speech service with Qwen3-TTS model)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:30 AM UTC
• Version: 1.0.2

Overview

This is a real voice-cloning speech server, but it needs review because it exposes an unauthenticated, resource-heavy API by default and lacks safeguards around voice samples.

Install only in a controlled environment. Bind the server to 127.0.0.1 unless you intentionally expose it, place authentication or a trusted reverse proxy in front of it, add rate limits and input limits, and use only voice reference audio you are authorized to clone. Pin and review dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/chichi_speech/server.py:49

Finding

Unauthenticated Resource-Intensive Synthesis Endpoint Exposed on All Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/chichi_speech/server.py:77

Finding

Internal Exception Details Disclosed to Unauthenticated Clients

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: pyproject.toml:6

Finding

Unpinned Third-Party Dependencies Create Supply-Chain and Build Reproducibility Risk

Content

View full analysis

=0.59.0", ] ``` The documented installation command resolves these dependencies dynamically: ```bash pip install -e . ``` ### Technical Analysis Most runtime dependencies have no version constraints, while `numba` has only a lower bound. The project does not include a reviewed lock file or hash-pinned dependency set in the audited directory. Consequently, installations performed at different times may resolve different package versions. A future compromised, malicious, or incompatible release satisfying these broad requirements could be downloaded during installation. Python packages can execute build backend or installation-related code, and imported runtime packages execute with the privileges of the process running the service. This finding identifies unsafe dependency management rather than evidence that any currently named dependency is malicious. ### Attack Path 1. A maintainer or attacker compromises a permitted dependency release, or a future release introduces a security regression. 2. A user follows the documented `pip install -e .` instruction. 3. The package resolver selects the new release because the project does not require a reviewed exact version and hash. 4. Installation/build behavior or later imports execute the selected package's code. 5. That code runs with the permissions of the user or environment performing installation or starting the service. ### Impact Assessment The potential scope is the Python environment and the privileges of the account performing installation or running the service. In a compromised-release scenario, impact could include arbitrary code execu ...[truncated 297 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior does not align with the declared purpose: the file claims a RESTful Qwen3 voice-cloning service with prompt reuse, but the evidence in the skill description does not substantiate those security-relevant claims. Behavior mismatches are dangerous because reviewers and users may trust capabilities, dependencies, and data flows that are inaccurate, masking hidden functionality or unsafe assumptions.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents network access and likely environment-dependent execution but does not declare any tool scope or permissions. This weakens sandboxing and review because consumers cannot easily understand or restrict what capabilities the skill expects, increasing the chance of unintended data access or network use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

2. Verify Service is Running

Check the health/docs:

bash

curl http://localhost:9090/docs

3. Generate Speech

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports user-provided reference audio for voice cloning without any consent, privacy, or anti-impersonation safeguards. In this context, that materially increases the risk of unauthorized cloning, misuse of biometric voice data, and privacy violations, especially because the feature is central to the service rather than incidental.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI sets the default --language value to Chinese, which means the skill will use a specific language unless the user explicitly overrides it. This is a natural-language policy concern because it imposes a locale/language choice by default rather than offering a neutral default or requiring user selection.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/chichi_speech/client.py (reported line 24)May include surrounding context.

python

print(f"Sending request to {endpoint}...")
    try:
        response = requests.post(endpoint, json=payload, stream=True)
        response.raise_for_status()
        
        with open(args.output, "wb") as f:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The request model hardcodes language: str = "Chinese", which forces a specific language/locale behavior whenever the caller does not explicitly override it. Under the policy, locale constraints should be user-chosen or clearly justified, and this file provides neither opt-in messaging nor a documented regional requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example request hard-codes "language": "English", which can be interpreted as a language policy constraint in the skill's natural-language guidance. The file does not state that other languages are supported or that English is only an example, so the documentation may imply an unjustified fixed-language expectation.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: fastapi has 3 known advisory(ies) (CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: uvicorn has 4 known advisory(ies) (CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a service centered on a specific reused voice prompt to avoid recomputation. However, the CLI allows operators to replace the hardcoded reference audio and text at startup, changing the cloned voice identity rather than strictly reusing one fixed prompt. This broadens behavior beyond the stated fixed-prompt optimization model.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.