VoiceMonkey

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This is a straightforward VoiceMonkey API guide for controlling Alexa devices, with one real credential-handling caution around an insecure GET example.

Install only if you intend to let an agent help operate VoiceMonkey-linked Alexa devices. Use the POST examples with the Authorization header, do not put VOICEMONKEY_TOKEN in URLs, and rotate the token if it was ever used in a query-string command or pasted into logs, screenshots, or shared diagnostics.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45

Finding

Secret API Token Exposed in a URL Query String

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–47
Vulnerability Type: Credential exposure through a URL query parameter
Risk Level: Medium

Vulnerable Code

bash

curl -X GET "https://api-v2.voicemonkey.io/announcement?token=$VOICEMONKEY_TOKEN&device=YOUR_DEVICE_ID&text=Hello%20from%20Echo"

Technical Analysis

The documented GET request places the secret VOICEMONKEY_TOKEN directly in the URL query string. Although HTTPS protects the request while it is in transit, query strings can still be retained in shell history, API gateway and reverse-proxy access logs, server logs, monitoring platforms, debugging output, and support diagnostics.

Anyone with access to such records may recover and reuse the bearer token. The same file provides a safer POST example using the Authorization header, demonstrating that placing the token in the URL is unnecessary.

Attack Path

1. A user follows the documented GET example with a valid VOICEMONKEY_TOKEN.
2. The token-bearing URL is recorded in shell history, infrastructure logs, monitoring telemetry, or diagnostic output.
3. An attacker or unauthorized operator obtains access to one of those records.
4. The attacker extracts the token from the token query parameter.
5. The attacker reuses the token in requests to the documented VoiceMonkey announcement, trigger, or flow endpoints.
6. The API performs actions against devices and resources associated with the compromised account, subject to the token's server-side permissions.

Impact Assessment

Successful exploitation exposes the authority granted to the VoiceMonkey token. Based on the documented API capabilities, an attacker may be able to:

• Send text-to-speech announcements to linked Alexa devices.
• Play attacker-selected audio or video and display images.
• Open websites on compatible Echo Show devices.
• Trigger configured Alexa routines.
• Start configured Voic ...[truncated 239 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the GET example that transmits VOICEMONKEY_TOKEN through the token query parameter.
2. Require POST requests with the token supplied only through the Authorization header:

   bash

   curl -X POST "https://api-v2.voicemonkey.io/announcement" \
     -H "Authorization: $VOICEMONKEY_TOKEN" \
     -H "Content-Type: application/json" \
     -d '{
       "device": "YOUR_DEVICE_ID",
       "text": "Hello from Echo"
     }'
   

3. Remove or deprecate documentation stating that the token parameter may be supplied in the URL.
4. Configure clients, proxies, and monitoring systems to redact authorization credentials and other sensitive request metadata.
5. Avoid enabling verbose command tracing when executing authenticated requests.
6. Advise users to rotate the token immediately if it may have appeared in shell history, logs, telemetry, screenshots, or diagnostics.
7. Where supported, use narrowly scoped and short-lived credentials to reduce the consequences of disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The GET example places the secret API token directly in the query string, which can leak through shell history, browser history, proxy logs, server logs, monitoring tools, and referrer-style propagation in adjacent tooling. Because this skill is specifically about controlling Alexa devices and triggering announcements/routines, exposure of the token could let an attacker send unauthorized commands to connected devices.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.