tencent-tts-podcast

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:04 PM UTC
• Version: 1.0.0

Overview

This skill mostly matches its text-to-speech purpose, but its optional cloud upload can make generated audio public and it may install a package at runtime without clear user warning.

Install only if you are comfortable sending text to Tencent Cloud and, if you enable COS upload, treating generated audio as potentially public. Use least-privilege Tencent credentials, avoid sensitive source text, keep upload_cos disabled unless needed, and prefer a reviewed version that removes runtime pip installation and uses private COS objects or signed URLs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: tts_podcast.py:528

Finding

COS Uploads Are Explicitly Made Publicly Readable

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: tts_podcast.py:514

Finding

Unpinned Package Installation Is Performed at Runtime

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Versions Are Not Reproducibly Pinned

Content

View full analysis

=3.0.0 cos-python-sdk-v5>=1.8.0 requests>=2.20.0 ``` ### Technical Analysis All dependencies use lower-bound-only constraints. A future installation may therefore select any newer matching release, including releases that were not reviewed or tested with this Skill. No integrity hashes are supplied to ensure that downloaded artifacts match approved files. This does not establish that any currently named dependency is malicious. The risk is that installations are not reproducible and automatically trust mutable future package versions and the configured package source. This expands the supply-chain attack surface and can also introduce security regressions or incompatible behavior. ### Attack Path 1. The Skill is installed at a later date or in a new environment. 2. Pip resolves the newest versions satisfying the broad `>=` constraints. 3. A compromised package release, compromised package repository, or otherwise unsafe future version is selected. 4. The package is installed without hash verification. 5. Installation-time or import-time package code executes with the privileges of the installing or running process. ### Impact Assessment If a selected dependency is compromised, arbitrary code could execute within the installation or Skill runtime context. Potentially accessible assets include Tencent credentials in memory or environment variables, local audio files, user text sent for conversion, and network resources available to the process. Actual scope depends on the operating-system account and deployment permissions. The constraints alone do not provide direct privilege escalation, but they weaken assurance that reviewed code is the code ultimately installed. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tainted flow: 'headers' from os.environ.get (line 294, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · tts_podcast.py (reported line 303)May include surrounding context.

python

"X-TC-Version": version
            }

            resp = requests.post(endpoint, headers=headers, data=payload.encode('utf-8'), timeout=timeout)
            resp.raise_for_status()
            response_data = resp.content.decode('utf-8', errors='replace')
            response_json = json.loads(response_data)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose is TTS generation, but the implementation reportedly also uploads audio to COS, may set uploaded objects to public-read, and dynamically installs external packages. These undeclared behaviors materially expand the trust boundary: generated content may be exposed publicly, credentials may be used for broader cloud actions than expected, and runtime package installation introduces supply-chain and arbitrary code execution risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

- `SKILL.md`

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Installing a package at runtime via pip is an unjustified capability for a TTS generator and creates a supply-chain and arbitrary code execution risk. It also changes the host environment state without clear consent, which is especially dangerous in shared runners or enterprise agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill can upload generated audio to cloud storage and return a public URL without strong user-facing warning or confirmation. In this skill's context, that is more dangerous because podcast text may include unpublished, internal, or personal content, and publication materially changes confidentiality expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill attempts to set uploaded objects to public-read, making generated audio internet-accessible by URL. Since the content is derived from user-provided text, this can unintentionally expose sensitive or proprietary material and is not necessary for basic TTS generation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill appears to require network access, environment access, and shell capability, but the manifest does not declare any tool scope or permission boundaries. This is dangerous because users and hosting platforms cannot easily tell that the skill may access secrets, make outbound requests, or invoke shell operations, increasing the chance of over-privileged execution and abuse if the implementation is modified or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill requests Tencent Cloud and COS credentials and transmits user-provided text and generated audio to external cloud services, but the documentation does not clearly warn about data handling, storage location, or privacy implications. This is risky because users may provide sensitive text or production credentials without understanding that content may be uploaded, stored remotely, or exposed via returned URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sends user text to Tencent Cloud's external TTS API but does not provide a clear user-facing disclosure in the interface or function contract about third-party processing. In contexts where text may contain confidential, regulated, or personal information, silent transmission to an external provider creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill includes optional COS upload and URL publication functionality that goes beyond the stated core purpose of generating podcast audio. This expands the data-handling surface and can cause user content to be persisted remotely and shared when a caller may reasonably expect only local TTS generation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The skill executes a runtime pip install when an import fails, which gives the code package-management and code-execution capability beyond ordinary TTS behavior. In a hostile or misconfigured environment this can install unexpected code, pull from an untrusted index configuration, or fail unpredictably, turning a content-generation skill into a software modification mechanism.

Content

Scanner excerpt · tts_podcast.py (reported line 519)May include surrounding context.

python

except ImportError:
        # Try to install
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "cos-python-sdk-v5", "-q"])
        from qcloud_cos import CosConfig, CosS3Client

    cfg = CosConfig(Region=region, SecretId=secret_id, SecretKey=secret_key)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function exposes only Chinese voice labels and its docstring states the input text 'supports Chinese', which imposes a locale-specific experience in natural language. Because the file does not present this as an explicit user opt-in or justified region-specific constraint, it matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound, which allows builds to resolve to different versions over time. This creates supply-chain and reproducibility risk because a future vulnerable or breaking release could be installed without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

This dependency is unpinned and may resolve to different versions depending on install time and environment. That weakens build reproducibility and can expose the skill to newly introduced vulnerable releases in the dependency chain.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The requests dependency is unpinned, so package resolution may select versions with known security flaws or future insecure releases. Because this skill interacts with cloud services and likely performs outbound HTTP operations, dependency drift in a networking library is more security-relevant than a purely local package.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The manifest includes requests without pinning a version, and requests has multiple published advisories affecting some releases. Since the installed version is not constrained, deployments could end up with an affected release, which is particularly concerning for a skill that communicates with external cloud endpoints and may handle credentials or sensitive URLs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill writes generated audio to local disk without clearly disclosing that behavior or defining storage location/lifetime. This can leave behind residual files containing sensitive spoken content, especially on shared systems or long-lived agent hosts.

Content

No source excerpt is available for this finding.