小野语音系统

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:31 PM UTC
• Version: 1.0.0

Overview

This is a coherent text-to-speech skill that generates local audio files, with the main caution that non-Chinese text is sent to Edge-TTS cloud processing.

Install only if you are comfortable with non-Chinese input text being processed by Microsoft Edge-TTS and any Telegram integration uploading generated audio to Telegram. Avoid using it with confidential text unless you restrict usage to the local Chinese macOS path or add a local-only control, and consider pinning edge-tts before deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:6

Finding

Unbounded Third-Party Dependency Version

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, line 6
Vulnerability Type: Unbounded third-party dependency
Risk Level: Medium

Vulnerable Code:

text

edge-tts>=6.1.9

Technical Analysis

The dependency specifies only a minimum version and therefore permits the package manager to install any future edge-tts release. Because the application imports this package and provides user-supplied text to it, package code executes within the application's security context and participates in network communication with a cloud TTS service.

This does not establish that the current dependency is malicious. However, a compromised or malicious future release could be selected automatically during a fresh installation or upgrade. Such a release could execute arbitrary Python code with the permissions of the application process and access data available to that process.

Attack Path

1. An attacker compromises the upstream package account, distribution process, or a future edge-tts release.
2. The attacker publishes a version newer than 6.1.9 containing malicious package code.
3. A user installs the project dependencies without a lock file or hash verification.
4. The package resolver accepts the compromised version because it satisfies edge-tts>=6.1.9.
5. The application imports edge_tts in generate_edge_tts at xiaoye_voice.py:133.
6. Malicious package code executes with the privileges of the application process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the operating-system account running the application. The attacker could access files, environment variables, network resources, and other data available to that account, including text submitted for speech generation. The scope is limited by the privileges and sandboxing of the application process; the reviewed code does not itself provide privilege escalation.

Remediation

View remediation

Remediation Suggestions

• Pin edge-tts to an exact, reviewed version rather than using a lower-bound-only constraint.
• Generate and commit a reproducible lock file.
• Record and enforce package hashes, such as with pip install --require-hashes.
• Review dependency release notes and provenance before updating the pin.
• Use automated dependency vulnerability and integrity scanning in CI.
• Run the application with least privilege and restrict access to unnecessary files, environment variables, and network destinations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that non-Chinese text uses Edge-TTS cloud synthesis but does not clearly warn that user-provided text will be transmitted to an external service. In a voice skill context, users may input personal, medical, or otherwise sensitive content, so lack of explicit disclosure can cause unintended privacy exposure and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that non-Chinese text uses Edge-TTS, a cloud service, but it does not clearly warn users that submitted text will leave the local device and be sent to a third party. This creates a privacy and data-handling risk, especially for an AI companion or caregiving context where users may provide sensitive personal content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The Telegram integration example encourages sending generated audio to a third-party messaging service without warning that the audio may contain sensitive content and will be transmitted externally. In combination with cloud TTS for non-Chinese text, this can create layered disclosure risks where both input text and output audio leave the user's environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Line L065 includes a natural-language comment stating that mixed Chinese-English text defaults to English. This imposes a language/locale preference without any indication of user opt-in or configurable choice, which matches the policy-violation criteria for forced language behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation emphasizes that Chinese TTS is 'fully local' while the implementation routes non-Chinese text to a cloud service, which can create a misleading privacy expectation for users. In a voice or assistant skill, that mismatch is security-relevant because users may submit sensitive content assuming it will stay on-device.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xiaoye_voice.py (reported line 98)May include surrounding context.

python

if self.debug:
                print(f"📝 命令: {' '.join(cmd)}")
            
            result = subprocess.run(cmd, capture_output=True, text=True)
            
            if result.returncode != 0:
                print(f"❌ macOS say失败: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xiaoye_voice.py (reported line 112)May include surrounding context.

python

str(output_path), "-y", "-loglevel", "error"
            ]
            
            result = subprocess.run(conv_cmd, capture_output=True, text=True)
            
            # 清理临时文件
            os.remove(aiff_file)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xiaoye_voice.py (reported line 178)May include surrounding context.

python

str(output_path), "-y", "-loglevel", "error"
            ]
            
            result = subprocess.run(conv_cmd, capture_output=True, text=True)
            
            # 清理临时文件
            os.remove(aiff_file)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code sends user-provided text directly to the edge_tts cloud service without any clear warning, consent flow, or privacy gating. If users provide secrets, personal data, or internal content, that data leaves the local environment and may be logged or processed by a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill automatically detects language and forces non-Chinese content through the cloud TTS path without user approval, removing meaningful user control over data handling. This is more dangerous in this skill context because language detection is tied directly to a privacy-affecting backend choice rather than just a quality setting.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · xiaoye_voice.py (reported line 235)May include surrounding context.

python

def list_available_voices(self):
        """列出可用的macOS语音"""
        try:
            result = subprocess.run(["say", "-v", "?"], capture_output=True, text=True)
            voices = []
            for line in result.stdout.strip().split('\n'):
                if line.strip():

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

README 以自然语言声明固定的双引擎策略：中文使用 Tingting，其他语种使用 Edge-TTS，呈现出默认绑定特定语言/区域语音方案的行为。虽然下文有部分初始化参数可改语音，但文档顶部的策略描述未体现用户语言/locale 选择或显式 opt-in。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The comment states that Edge-TTS is used for 'non-Chinese voice,' which implies the skill treats Chinese as the default or preferred language path. This suggests a language/locale behavior constraint in natural-language text without indicating user choice or opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The dependency is specified as edge-tts>=6.1.9, which permits installation of any newer version, including unreviewed releases. This can lead to non-reproducible builds and increased supply-chain risk if a future version introduces vulnerabilities or malicious behavior.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

# 注意: macOS say命令和ffmpeg是系统依赖，不在此列出

# 可选依赖 - Edge-TTS (用于非中文语音)
edge-tts>=6.1.9

# 开发依赖
# (无)

Static analysis

No suspicious patterns detected.