Multi Edge Tts Cn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:18 AM UTC
• Version: 2.3.1

Overview

The skill is a coherent Chinese Edge-TTS audio generator, but its output path checks do not enforce the documented whitelist and can overwrite arbitrary writable files.

Review this before installing. Use only trusted text and explicit output paths under /tmp/openclaw or the documented OpenClaw media/workspace directories, and avoid running the installer in a privileged or system Python environment. The package is not judged malicious, but the arbitrary writable output path and unpinned dependency install should be fixed before routine use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:32

Finding

Unpinned Dependency Installation into the System Python Environment

Content

View full analysis

/dev/null || \ pip3 install --user edge-tts 2>/dev/null || \ pip3 install edge-tts 2>/dev/null ``` ### Technical Analysis The installation script downloads `edge-tts` without specifying the documented version or verifying the integrity of the downloaded artifacts. Although `SKILL.md` identifies version `7.2.8`, the installer resolves whichever release is current when installation occurs. The first installation attempt also uses `--break-system-packages`, bypassing Python protections intended to prevent `pip` from modifying an externally managed system environment. This can overwrite distribution-managed packages or create incompatible dependency combinations. This is a supply-chain risk rather than evidence that the current `edge-tts` package is malicious. Exploitation would require compromise of the package, its distribution account, the configured package index, or the dependency resolution path. ### Attack Path 1. An attacker compromises the package distribution account, package index, or another dependency resolved during installation. 2. The attacker publishes a malicious or altered release that satisfies the unrestricted package request. 3. A user executes `scripts/install.sh`. 4. `pip3` retrieves the mutable package release and executes its installation process. 5. Malicious installation or runtime code executes with the privileges of the user running the script. 6. If the installer is run by an administrator, or against a privileged Python environment, the impact extends to that privileged environment. ### Impact Assessment Successful supply-chain exploitation could allow arbitrary code execution under the invoking user's account, access to that user's files and environment variables, and m ...[truncated 355 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/engine.py:111

Finding

Ineffective Output-Path Allowlist Permits Arbitrary Writable File Overwrite

Content

View full analysis

Remediation

View remediation

bool: destination = Path(output_path).expanduser().resolve(strict=False) allowed_dirs = [ Path("/tmp/openclaw").resolve(), Path("~/.openclaw/media").expanduser().resolve(), Path("~/.openclaw/workspace").expanduser().resolve(), Path("~/.openclaw/sandboxes").expanduser().resolve(), ] return any(destination.is_relative_to(base) for base in allowed_dirs) ``` 3. Enforce the result in `generate()`: ```python if not validate_output_path(output_path): return 1, "" ``` 4. Reject existing symlink destinations and verify that each existing parent component does not redirect outside the approved directory. 5. Avoid blindly overwriting existing files. Generate a unique filename or use exclusive file creation unless replacement was explicitly requested by a trusted caller. 6. Revalidate the canonical destination immediately before writing to reduce time-of-check/time-of-use exposure. 7. Restrict destination extensions to the explicitly supported audio formats and apply conservative permissions to generated files and directories. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation describes capabilities that require network access, shell execution, and file reads, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: an agent may invoke broader capabilities than a user or platform expects, increasing the risk of unintended command execution, external data transmission, or file access in a networked TTS workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The text specification states '使用中文标点' and defines pause behavior around Chinese punctuation, which imposes a specific language/locale convention. The file does not present this as an option or a region-specific requirement, so it reads as a forced locale policy in the skill guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring, CLI help, and user-facing messages are written entirely in Chinese, which imposes a specific language on users and calling agents. Under the policy, locale or language constraints should either be optional/opt-in or clearly documented as a justified regional restriction, which is not stated here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/engine.py (reported line 69)May include surrounding context.

python

return False
    
    # 检查 ffmpeg
    result = subprocess.run(
        ["ffmpeg", "-version"], 
        capture_output=True, 
        text=True

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

validate_output_path() claims to validate writes to allowed directories, but it only prints a warning and still returns True, so callers can write output files anywhere the process has permission. In this skill context, the agent may accept externally influenced output_path values, enabling arbitrary file creation or overwrite in user-owned locations, which is more dangerous because the tool is explicitly designed to write files on demand.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/engine.py (reported line 222)May include surrounding context.

python

# AMR 格式需要 8kHz 采样率
    sample_rate = "8000" if ext == ".amr" else "48000"

    result = subprocess.run(
        [
            "ffmpeg", "-y", "-i", mp3_path,
            "-ar", sample_rate, "-ac", "1",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This shell script presents its instructions, status messages, and usage text entirely in Chinese, including the installation banner, errors, and final invocation guidance. That imposes a specific language on all users without opt-in, which matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 52)May include surrounding context.

sh

ffmpeg_ver=$(ffmpeg -version 2>&1 | head -1)
    echo "✅ ffmpeg: $ffmpeg_ver"
else
    echo "❌ 需要 ffmpeg，请安装: sudo apt install ffmpeg"
    exit 1
fi

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest-style JSON defines only zh-CN, zh-HK, and zh-TW voices and uses a Chinese voice as the default, which indicates an effective language/locale constraint. Because the file provides no natural-language justification or indication that users can opt into this locale restriction, it may conflict with policy against forcing a specific language or locale.

Content

No source excerpt is available for this finding.