ClawHub
Back to skill

Security audit

Iflytek Hyper Tts

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed iFlytek text-to-speech skill that sends user-provided text to the iFlytek API and saves returned audio locally, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you are comfortable sending the text you synthesize to iFlytek's remote service using your iFlytek credentials. Avoid submitting secrets, regulated data, or private content unless that use is approved. For safer installation, use a virtual environment and pin or lock websocket-client rather than installing the latest package implicitly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:287
Finding

Mutable and Unverified Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:287-291
Additional Location: README.md:7-11
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

SKILL.md:287-291:

bash
pip install websocket-client>=1.6.0

README.md:7-11:

bash
pip install websocket-client

Technical Analysis

The installation instructions retrieve websocket-client from the active Python package index without requiring an exact audited version or validating an integrity hash. The version constraint in SKILL.md accepts every release at or above version 1.6.0, while the instruction in README.md implicitly selects the latest available release.

Consequently, the code installed and imported by the Skill can change after the Skill itself has been audited. Python packages may execute code during installation and whenever imported. This creates a supply-chain trust boundary that is not protected by a lock file, cryptographic hashes, or a documented trusted package source.

The dependency name appears to refer to a legitimate package, and the reviewed project does not itself contain evidence that the current package is malicious. The risk arises from mutable, unverified future package contents or a compromised package index.

Attack Path

  1. An attacker compromises a permitted package repository, publisher account, package release, or the package-index configuration used by the Agent environment.
  2. The attacker publishes or serves a malicious version satisfying websocket-client>=1.6.0, or causes the unconstrained installation command to resolve to malicious content.
  3. A user or Agent follows the documented pip install command.
  4. Attacker-controlled package code executes during installation or when scripts/xfei_hyper_tts.py imports websocket.
  5. The malicious dependency operates with the privileges of the user running pip or the TTS scr ...[truncated 922 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specific audited version rather than using a lower-bound or unconstrained requirement:

    text
    websocket-client==<audited-version>

  2. Generate and commit a dependency lock file containing cryptographic hashes. Install it with hash verification enabled:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  3. Ensure every package and transitive dependency in the requirements file has an approved SHA-256 hash.

  4. Configure pip to use a trusted, controlled package index or internal artifact repository rather than relying on arbitrary environment-specific index configuration.

  5. Install dependencies in an isolated virtual environment or container under a non-privileged account.

  6. Regularly scan the locked dependency version for known vulnerabilities and update it through a reviewed dependency-upgrade process.

  7. Make README.md and SKILL.md use the same reproducible installation procedure so users are not directed to bypass version and integrity controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documented purpose understates several material behaviors: sending user text to an external service, reading local files, writing audio files locally, requiring API credentials, and supporting voice enumeration outside the stated curated scope. This mismatch can cause users or orchestrators to invoke the skill under false assumptions, leading to privacy leaks, unintended filesystem access, and policy bypass in environments that rely on descriptions for routing and approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to provide API credentials and send arbitrary text to a remote TTS provider, but it does not warn that submitted content and secrets are involved in third-party processing. This can lead users to unknowingly transmit sensitive prompts, personal data, or regulated content to an external service, creating privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares no explicit tool scope or permissions despite clearly requiring environment variables, local file access, and outbound network access to a third-party WebSocket API. This creates an authorization and review gap: operators and calling agents cannot reliably constrain what the skill is allowed to access, increasing the chance of unintended secret exposure or unsafe invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description omits a critical privacy-relevant behavior: user-provided text is sent to an external iFlytek TTS service and the resulting audio is saved locally. Users and orchestrators may treat the skill as a local transformation and unknowingly submit sensitive content, creating a real data exposure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger guidance uses broad, everyday phrases like '读出来' that may match ordinary conversational requests and cause the skill to auto-invoke unexpectedly. In context, unexpected invocation is risky because the skill transmits text to an external provider and writes output files locally, so accidental activation can lead to privacy leakage and unintended side effects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly states 'Skill 默认只开放以下 7 个精选发音人' and later repeats that the skill '默认只支持 7 个精选发音人', yet it also provides examples using x5_lingfeiyi_flow and lists multiple additional free voices. That is an active contradiction between the stated intended restriction and the documented/likely accepted behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script transmits arbitrary user-supplied text to a third-party TTS provider over the network without an explicit privacy warning, consent mechanism, or data-classification guardrail. In a skill context, users may submit sensitive prompts, credentials, or personal data, creating a real confidentiality risk through unintended external disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code comments and CLI help advertise role support for some voices, and synthesize() conditionally injects role into the request. But main() does not pass args.role to client.synthesize, so the documented capability is not actually exercised from the command-line entrypoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Natural-language policy issues include forcing a specific language without user opt-in. This README presents all instructions in Chinese only and does not indicate any alternative language option or explicit locale limitation, which may conflict with organizational language-choice expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest and earlier usage sections describe this skill as producing MP3 output and list --encoding as lame(MP3) only, but the FAQ claims support for PCM, Speex, and Opus as well. This creates a semantic mismatch within the skill documentation about what the skill actually offers to users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Natural-language strings in the docstring and CLI help force a Chinese-language interaction model, and the file does not indicate that this is optional or limited to a region-specific deployment context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring states the default speaker is 聆小糖 (x5_lingxiaotang_flow), and the argument parser also defaults to that VCN. However, the FREE_VOICES list marks x5_lingxiaoxuan_flow as "default": True, creating an active contradiction between documentation/default semantics and the data the tool exposes via list_voices.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The logging code conditionally prints an omni_params attribute, implying an exposed synthesis attribute set that is not present in the function signature, request construction, or CLI. This contradicts the implemented interface and indicates stale intent/documentation embedded in code comments/logging.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/xfei_hyper_tts.py:198