Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local text-to-speech skill, but its script has high-impact input-handling and dependency risks that deserve review before installation.
Install only if you trust the VibeVoice source checkout, dependencies, model downloads, and any inputs passed to the voice option. Avoid exposing this script to untrusted voice names or environment variables; pin dependencies and the upstream repo before use.
scripts/vv.sh:24Arbitrary Python Code Injection Through the Voice Parameter
scripts/vv.sh:103Unsafe PyTorch Checkpoint Deserialization Combined With Path Traversal
SKILL.md:17Unpinned Repository and Python Dependencies Create a Mutable Supply-Chain Risk
The README repeatedly frames the skill as producing Spanish speech, including 'Local Spanish text-to-speech' and 'Natural Spanish voice,' without indicating that users can choose another language or explicitly opt into the locale constraint. This is a natural-language locale policy concern because the skill appears to impose a specific language by default rather than presenting it as a user-selected or clearly justified regional limitation.
The description states the skill is for 'Local Spanish TTS' and presents Spanish generation as the default behavior. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is clearly documented as region-specific or the user is offered a choice.
The script changes into a user-controlled directory and sources its virtual environment activation script before running Python, so any attacker who can influence VIBEVOICE_DIR or the contents of that directory can execute arbitrary shell/Python code. This is especially dangerous because source venv/bin/activate executes shell commands directly in the current process, not just an isolated interpreter.
The script claims to be local TTS but loads the model using a remote Hugging Face-style identifier, which can trigger network access and pull code/artifacts outside the packaged skill boundary. That creates a supply-chain and privacy risk because model resolution may download unpinned content at runtime and violate user expectations of fully local execution.
The usage examples show the skill creating audio files at paths like /tmp/audio.ogg, which is a user-data-affecting file write. The README describes features and usage but does not include any warning or disclosure that running the command will write or overwrite an output file at the specified path.
The comment explicitly describes the tool as "Local Spanish TTS," which signals a fixed language/locale behavior. The file does not offer any user opt-in or explain why Spanish is required, so this is a natural-language locale policy concern under the stated rules.
Detected: suspicious.dynamic_code_execution