tencent-tts-podcast

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:04 PM UTC
• Version: 1.0.0

Overview

This skill mostly matches its text-to-speech purpose, but its optional cloud upload can make generated audio public and it may install a package at runtime without clear user warning.

Install only if you are comfortable sending text to Tencent Cloud and, if you enable COS upload, treating generated audio as potentially public. Use least-privilege Tencent credentials, avoid sensitive source text, keep upload_cos disabled unless needed, and prefer a reviewed version that removes runtime pip installation and uses private COS objects or signed URLs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: tts_podcast.py:528
• Finding: COS Uploads Are Explicitly Made Publicly Readable<![CDATA[ ## Vulnerability Details **File Location**: `tts_podcast.py:528-539` **Vulnerability Type**: Public exposure of generated audio through an insecure object ACL **Risk Level**: High ### Vulnerable Code ```python cli.put_object_from_local_file( Bucket=bucket_full, LocalFilePath=local_path, Key=object_key, ContentType=content_type ) try: cli.put_object_acl(Bucket=bucket_full, Key=object_key, ACL="public-read") except: pass ``` ### Technical Analysis When the optional `upload_cos` feature is enabled, the generated audio file is uploaded to Tencent Cloud Object Storage and the code then explicitly assigns the object a `public-read` ACL. Anonymous users can consequently retrieve the object without Tencent Cloud authentication if they obtain or discover its URL. The generated audio is derived directly from user-provided text. That text may contain personal information, confidential business material, internal documents, credentials spoken as text, or other sensitive content. Public access is not required for the declared text-to-speech capability. If external sharing is needed, a private object with a short-lived signed URL would provide the functionality with substantially less exposure. The broad `except` block suppresses ACL errors. This makes the final access state difficult to determine and prevents callers from receiving reliable information about whether the object is public or private. ### Attack Path 1. A user or calling agent supplies sensitive text for speech generation. 2. The caller enables `upload_cos`. 3. The Skill sends the text to Tencent TTS and creates a local WAV file. 4. `_upload_to_cos()` uploads that WAV file to the configured COS bucket. 5. The Skill assigns `ACL="public-read"` to the uploaded object. 6. An unauthenticated party obtains or discovers the predictable COS host and returned object URL. 7. The party downloads the generated audio without possessing Tencent credentials. ### Impact Assessment T ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the explicit public ACL assignment: ```python cli.put_object_acl( Bucket=bucket_full, Key=object_key, ACL="public-read", ) ``` 2. Store generated audio as private objects by default and rely on the bucket's secure default access policy. 3. If temporary external access is required, generate a short-lived pre-signed URL with the minimum necessary lifetime. 4. Require a separate, explicit option and a clear warning before making any object public. 5. Replace the broad `except` block with specific exception handling. Return an error if the requested access policy cannot be applied or verified. 6. Consider encryption, retention limits, and automatic object deletion for generated audio containing potentially sensitive information. 7. Document that both source text and uploaded audio leave the local environment when cloud features are used. ]]>

T08 · Insecure Dependencies

Warning

• Location: tts_podcast.py:514
• Finding: Unpinned Package Installation Is Performed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `tts_podcast.py:514-520` **Vulnerability Type**: Runtime dependency retrieval and installation from a mutable package source **Risk Level**: Medium ### Vulnerable Code ```python try: from qcloud_cos import CosConfig, CosS3Client except ImportError: # Try to install import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "cos-python-sdk-v5", "-q"]) from qcloud_cos import CosConfig, CosS3Client ``` ### Technical Analysis If the COS SDK cannot be imported, invoking the upload feature launches `pip` as a subprocess and installs `cos-python-sdk-v5` dynamically. No exact package version or integrity hash is specified. Package installation can execute package build hooks and other installation-time code with the same privileges as the Python process. The package source is determined by the runtime pip configuration and environment, which may include an untrusted mirror, proxy, extra package index, or compromised account. Because the dependency is mutable, the code actually installed can differ from the version reviewed during this audit. Runtime installation is not necessary for the Skill's declared functionality because `cos-python-sdk-v5` is already listed in `requirements.txt`. Missing dependencies should be handled as a deployment error rather than repaired by executing an uncontrolled package installation during a Skill invocation. ### Attack Path 1. The COS upload path is invoked in an environment where `qcloud_cos` is unavailable or intentionally made unavailable. 2. The `ImportError` handler executes `python -m pip install cos-python-sdk-v5 -q`. 3. Pip resolves the package using the process's configured indexes, mirrors, proxies, and trust settings. 4. An attacker who controls or has compromised a configured package source serves a malicious matching distribution, or a compromised future package release is selected. 5. Pip downloads and installs the distri ...[truncated 692 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic package installation from `_upload_to_cos()`. 2. If the import fails, return a clear error instructing the operator to install dependencies through the controlled deployment process. 3. Install dependencies before execution from a reviewed lock file. 4. Pin the COS SDK and its transitive dependencies to reviewed versions. 5. Use package hashes, such as pip's `--require-hashes`, to verify downloaded artifacts. 6. Restrict installation to a trusted package index and review pip configuration in deployment environments. 7. Run the Skill under a dedicated, unprivileged account with access only to required files and cloud operations. ]]>

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1
• Finding: Dependency Versions Are Not Reproducibly Pinned<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-3` **Vulnerability Type**: Mutable third-party dependency resolution without upper bounds or integrity hashes **Risk Level**: Low ### Vulnerable Code ```text tencentcloud-sdk-python>=3.0.0 cos-python-sdk-v5>=1.8.0 requests>=2.20.0 ``` ### Technical Analysis All dependencies use lower-bound-only constraints. A future installation may therefore select any newer matching release, including releases that were not reviewed or tested with this Skill. No integrity hashes are supplied to ensure that downloaded artifacts match approved files. This does not establish that any currently named dependency is malicious. The risk is that installations are not reproducible and automatically trust mutable future package versions and the configured package source. This expands the supply-chain attack surface and can also introduce security regressions or incompatible behavior. ### Attack Path 1. The Skill is installed at a later date or in a new environment. 2. Pip resolves the newest versions satisfying the broad `>=` constraints. 3. A compromised package release, compromised package repository, or otherwise unsafe future version is selected. 4. The package is installed without hash verification. 5. Installation-time or import-time package code executes with the privileges of the installing or running process. ### Impact Assessment If a selected dependency is compromised, arbitrary code could execute within the installation or Skill runtime context. Potentially accessible assets include Tencent credentials in memory or environment variables, local audio files, user text sent for conversion, and network resources available to the process. Actual scope depends on the operating-system account and deployment permissions. The constraints alone do not provide direct privilege escalation, but they weaken assurance that reviewed code is the code ultimately installed. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace lower-bound-only constraints with exact, reviewed versions. 2. Generate and commit a lock file that includes transitive dependencies. 3. Record cryptographic hashes for approved distributions and install with hash verification. 4. Use automated dependency scanning and a controlled process for reviewing and updating pinned versions. 5. Retrieve packages only from trusted repositories and disable unnecessary additional indexes. 6. Rebuild and test the lock file regularly so security updates are adopted deliberately rather than implicitly. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

Tainted flow: 'headers' from os.environ.get (line 294, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"X-TC-Version": version
            }

            resp = requests.post(endpoint, headers=headers, data=payload.encode('utf-8'), timeout=timeout)
            resp.raise_for_status()
            response_data = resp.content.decode('utf-8', errors='replace')
            response_json = json.loads(response_data)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is TTS generation, but the implementation reportedly also uploads audio to COS, may set uploaded objects to public-read, and dynamically installs external packages. These undeclared behaviors materially expand the trust boundary: generated content may be exposed publicly, credentials may be used for broader cloud actions than expected, and runtime package installation introduces supply-chain and arbitrary code execution risk.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Installing a package at runtime via `pip` is an unjustified capability for a TTS generator and creates a supply-chain and arbitrary code execution risk. It also changes the host environment state without clear consent, which is especially dangerous in shared runners or enterprise agents.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill can upload generated audio to cloud storage and return a public URL without strong user-facing warning or confirmation. In this skill's context, that is more dangerous because podcast text may include unpublished, internal, or personal content, and publication materially changes confidentiality expectations.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill attempts to set uploaded objects to `public-read`, making generated audio internet-accessible by URL. Since the content is derived from user-provided text, this can unintentionally expose sensitive or proprietary material and is not necessary for basic TTS generation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill appears to require network access, environment access, and shell capability, but the manifest does not declare any tool scope or permission boundaries. This is dangerous because users and hosting platforms cannot easily tell that the skill may access secrets, make outbound requests, or invoke shell operations, increasing the chance of over-privileged execution and abuse if the implementation is modified or compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill requests Tencent Cloud and COS credentials and transmits user-provided text and generated audio to external cloud services, but the documentation does not clearly warn about data handling, storage location, or privacy implications. This is risky because users may provide sensitive text or production credentials without understanding that content may be uploaded, stored remotely, or exposed via returned URLs.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill sends user text to Tencent Cloud's external TTS API but does not provide a clear user-facing disclosure in the interface or function contract about third-party processing. In contexts where text may contain confidential, regulated, or personal information, silent transmission to an external provider creates privacy and compliance risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill includes optional COS upload and URL publication functionality that goes beyond the stated core purpose of generating podcast audio. This expands the data-handling surface and can cause user content to be persisted remotely and shared when a caller may reasonably expect only local TTS generation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        # Try to install
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "cos-python-sdk-v5", "-q"])
        from qcloud_cos import CosConfig, CosS3Client

    cfg = CosConfig(Region=region, SecretId=secret_id, SecretKey=secret_key)

• Confidence: 96% confidence
• Finding: The skill executes a runtime `pip install` when an import fails, which gives the code package-management and code-execution capability beyond ordinary TTS behavior. In a hostile or misconfigured environment this can install unexpected code, pull from an untrusted index configuration, or fail unpredictably, turning a content-generation skill into a software modification mechanism.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The function exposes only Chinese voice labels and its docstring states the input text 'supports Chinese', which imposes a locale-specific experience in natural language. Because the file does not present this as an explicit user opt-in or justified region-specific constraint, it matches the language/locale policy violation criteria.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

• Confidence: 94% confidence
• Finding: The dependency is specified with only a lower bound, which allows builds to resolve to different versions over time. This creates supply-chain and reproducibility risk because a future vulnerable or breaking release could be installed without review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

• Confidence: 94% confidence
• Finding: This dependency is unpinned and may resolve to different versions depending on install time and environment. That weakens build reproducibility and can expose the skill to newly introduced vulnerable releases in the dependency chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

tencentcloud-sdk-python>=3.0.0
cos-python-sdk-v5>=1.8.0
requests>=2.20.0

• Confidence: 98% confidence
• Finding: The requests dependency is unpinned, so package resolution may select versions with known security flaws or future insecure releases. Because this skill interacts with cloud services and likely performs outbound HTTP operations, dependency drift in a networking library is more security-relevant than a purely local package.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The manifest includes requests without pinning a version, and requests has multiple published advisories affecting some releases. Since the installed version is not constrained, deployments could end up with an affected release, which is particularly concerning for a skill that communicates with external cloud endpoints and may handle credentials or sensitive URLs.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill writes generated audio to local disk without clearly disclosing that behavior or defining storage location/lifetime. This can leave behind residual files containing sensitive spoken content, especially on shared systems or long-lived agent hosts.

Static analysis

No suspicious patterns detected.