Smart Speak Multilingual TTS (Jaskies)

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:49 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward text-to-speech helper, but users should review its system install command, unpinned Python dependency, cloud TTS privacy implications, and hard-coded local path before using it.

Install only after reviewing the sudo and pip commands. Prefer a virtual environment, pinned dependency versions, and a corrected edge-tts path for your machine. Do not synthesize confidential or sensitive text unless you are comfortable with the TTS provider receiving that content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–24
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Install edge-tts
python3 -m pip install edge-tts

Technical Analysis

The documented installation command downloads the current edge-tts release and its transitive dependencies without a version constraint, lockfile, or cryptographic hash verification. Consequently, the code installed by users can differ from the dependency version that was reviewed during this audit.

This is a supply-chain weakness rather than evidence that the current edge-tts package is malicious. Exploitation would require compromise of the package, its release process, the package index, or one of its unconstrained transitive dependencies.

Attack Path

1. An attacker compromises an upstream package release, maintainer account, distribution channel, or transitive dependency.
2. The attacker publishes a malicious version under the expected package identity.
3. A user follows the skill's documented python3 -m pip install edge-tts command.
4. pip resolves and installs the attacker-controlled release because no reviewed version or hashes are enforced.
5. Malicious package code executes during installation or when smart_speak.py invokes edge-tts.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account installing or running the package. Depending on those privileges, the attacker could access that user's files and environment variables, tamper with generated output, make unauthorized network requests, or establish further compromise. The skill itself does not request elevated privileges for the pip command, so this finding does not independently demonstrate root-level compromise.

Remediation

View remediation

Remediation Suggestions

1. Pin edge-tts and every transitive dependency to reviewed versions in a requirements or lock file.
2. Record and enforce cryptographic hashes, for example:

bash

python3 -m pip install --require-hashes -r requirements.txt

3. Generate the lock file from a trusted environment and review dependency changes before updating it.
4. Install dependencies inside a dedicated virtual environment rather than the user's global environment.
5. Use a trusted package index and consider an internally controlled package mirror for higher-assurance deployments.
6. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (8)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# Cài đặt ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# Cài đặt edge-tts
python3 -m pip install edge-tts

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents shell execution and file output behavior but does not declare any tool scope such as shell or file-write permissions. That mismatch weakens user and platform visibility into what the skill may do, making it easier for an agent to invoke capabilities without explicit review or least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill promotes use of edge-tts, which sends text to an external text-to-speech service, but it does not warn users that their input content may leave the local environment. This creates a privacy and data-handling risk, especially if users synthesize sensitive lesson content, names, or internal material.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The documentation instructs users to run a command with sudo to install ffmpeg. Encouraging privileged command execution increases risk because users may execute copied instructions without scrutiny, and any future modification of the command chain or surrounding install flow could result in system-wide changes or damage.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash

# Cài đặt ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# Cài đặt edge-tts
python3 -m pip install edge-tts

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code defaults to the specific voice "vi-VN-HoaiMyNeural", which imposes a Vietnamese language/locale choice whenever a segment does not provide a voice. This is a natural-language policy concern because the skill selects a locale-specific output without asking the user or documenting that the tool is region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smart_speak.py (reported line 51)May include surrounding context.

python

"--write-media", temp_file
                ]
                
                result = subprocess.run(cmd, capture_output=True, text=True)
                if result.returncode != 0:
                    print(f"Error generating TTS for segment {i}: {result.stderr}", file=sys.stderr)
                    continue

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smart_speak.py (reported line 72)May include surrounding context.

python

args.output
        ]
        
        result = subprocess.run(ffmpeg_cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Error merging audio with ffmpeg: {result.stderr}", file=sys.stderr)
            sys.exit(1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown presents fixed preferred voices for Vietnamese, Chinese, and U.S. English, including a specific regional English locale (en-US-AvaNeural), without stating that users can choose a different language or locale. This can violate language/locale policy when a skill implicitly enforces a locale rather than offering choice.

Content

No source excerpt is available for this finding.