edge-tts-auto

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This text-to-speech skill is understandable in purpose, but a normal run can make privileged system changes and write to arbitrary caller-supplied paths.

Review before installing. This skill should only be used on a machine where you are comfortable with it running sudo package-manager commands, installing unpinned Python tooling, and modifying the user's shell PATH. Prefer installing dependencies manually in a controlled environment and restricting output paths to a dedicated audio directory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: main.sh:9

Finding

Unpinned Runtime Installation of Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.sh:8

Finding

Privileged System Modification During Skill Invocation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.sh:18

Finding

Unrestricted Caller-Controlled Output File Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: main.sh:27

Finding

Unsafe Construction of JSON Response Using Caller-Controlled Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically performs system package installation and modifies the user's shell environment on first run, even though its primary purpose is text-to-speech. This creates unnecessary privileged side effects, expands the trust boundary, and can be abused or cause damage on hosts where skills are expected to be non-invasive.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The explicit use of sudo to run apt update elevates the script's required privileges and can trigger privileged operations as part of routine execution. In a skill with an unstated need for host administration, this is an unjustified privilege escalation risk and increases blast radius if the script or its supply chain is compromised.

Content

Scanner excerpt · main.sh (reported line 9)May include surrounding context.

sh

# ==========================
if ! command -v edge-tts &> /dev/null; then
  echo "正在自动安装 edge-tts..."
  sudo apt update
  sudo apt install -y pipx jq
  pipx ensurepath
  source ~/.bashrc

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script invokes sudo apt operations and shell environment changes without any user confirmation, warning, or dry-run behavior. In an agent skill context, this is dangerous because executing the skill can unexpectedly trigger privileged system changes, potentially altering the host or failing in unsafe ways.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Using sudo apt install causes the skill to install packages with root privileges during normal execution. This is risky because it changes the system state, depends on external repositories, and grants unnecessary administrative power to a task that should only convert text to speech.

Content

Scanner excerpt · main.sh (reported line 10)May include surrounding context.

sh

if ! command -v edge-tts &> /dev/null; then
  echo "正在自动安装 edge-tts..."
  sudo apt update
  sudo apt install -y pipx jq
  pipx ensurepath
  source ~/.bashrc
  pipx install edge-tts

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The selected voice zh-CN-XiaoxiaoNeural forces Chinese-language locale behavior, and the surrounding user-facing messages are also Chinese-only. The file does not offer a language/locale choice or document why this locale restriction is required, which creates a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that the first run will update package lists and install system and Python dependencies, but it does not present this as a prominent warning before use. This can lead users to run the skill without informed consent, causing unexpected system modification, package installation, and potential supply-chain exposure from network-fetched components.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The output file path is taken directly from user input and passed to the TTS tool without validation or restriction. While this is not shell injection because arguments are quoted, it still allows arbitrary file overwrite or writing to sensitive locations accessible to the current user, which can damage files or be chained with other attacks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest uses Chinese-only natural-language descriptions for the skill and tool, with no indication that language is configurable or intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when skills are expected to be language-neutral or to offer user opt-in for a specific language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The document specifically advertises support for the Chinese female voice zh-CN-XiaoxiaoNeural and all invocation examples are in Chinese, without stating that users may choose another language or voice. This can be read as a locale constraint that is not documented as optional or justified as region-specific.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.