Tts Voice Ai

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:47 AM UTC
• Version: 1.1.0

Overview

This is a coherent MiniMax text-to-speech skill that sends requested text to MiniMax and writes audio locally, with some privacy and consent guidance users should consider.

Before installing, treat any text you synthesize as data sent to MiniMax and avoid secrets, regulated data, or confidential material unless that use is approved. Use cloned voices only with clear permission from the voice owner, and consider pinning the requests dependency in controlled environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: Unpinned Third-Party Python Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7-10 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml requires: bins: [python3] env: [MINIMAX_API_KEY] pip: [requests] ``` ### Technical Analysis The Skill declares `requests` without a fixed version or integrity hash. As a result, installation may resolve to a different package version over time. If the package distribution channel or a future release is compromised, installation could introduce attacker-controlled code even though the reviewed Skill source remains unchanged. The dependency name is legitimate and no malicious package source, dependency confusion namespace, or typosquatting was identified. The risk arises from mutable dependency resolution rather than confirmed malicious behavior in the current package. ### Attack Path 1. An operator or automated Skill installer processes the `pip: [requests]` dependency declaration. 2. The package manager resolves the dependency from its configured package index without enforcing a reviewed version or cryptographic hash. 3. An attacker compromises the package index, distribution account, installation environment, or a future dependency release. 4. The installer downloads the compromised package or one of its transitive dependencies. 5. Attacker-controlled package installation or runtime code executes with the privileges of the user or Agent installing or invoking the Skill. 6. That code could access data available to the process, including the `MINIMAX_API_KEY`, user-provided TTS text, generated files, and other resources permitted to the host account. ### Impact Assessment Successful exploitation could result in arbitrary code execution within the privileges of the installing or executing account. The affected scope could include environment variables, local files accessible to that account, network access available to the process, and TTS input content. No evidenc ...[truncated 569 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `requests` to a specifically reviewed version instead of allowing unrestricted resolution, for example: ```yaml pip: [requests==<reviewed-version>] ``` 2. Use a lock file or requirements file that also pins all transitive dependencies. 3. Require cryptographic hashes during installation, such as pip's `--require-hashes` mode with SHA-256 hashes for every resolved package. 4. Install packages only from an explicitly trusted package index using TLS, and prevent fallback to untrusted or user-controlled indexes. 5. Run dependency vulnerability and provenance checks in CI before publishing the Skill. 6. Periodically update the pinned versions through a controlled review process rather than accepting automatic mutable upgrades. 7. Where supported, install and execute the Skill in an isolated environment with access limited to the required API credential, destination domains, input text, and output directory. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to submit arbitrary text to a third-party TTS provider but does not clearly disclose that the input content leaves the local environment and is processed by MiniMax. Users may unknowingly send sensitive prompts, personal data, or confidential business content to an external service, creating privacy, compliance, and data-handling risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises voice cloning without any warning about consent, impersonation risk, or the sensitive biometric nature of voice data. This can facilitate misuse such as cloning another person's voice without authorization, and it fails to warn users about legal, ethical, and privacy obligations around biometric identifiers.

External Transmission

Medium

• Category: Data Exfiltration

Content

data = {"voice_type": "all"}
    
    try:
        resp = requests.post(voice_url, headers=headers, json=data, timeout=30)
        resp.raise_for_status()
        result = resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        print(f"Generating speech...", file=sys.stderr)
        resp = requests.post(tts_url, headers=headers, json=payload, timeout=60)
        resp.raise_for_status()
        result = resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.