ClawHub
Back to skill

Security audit

doubao-tts

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Doubao text-to-speech skill that sends chosen text to a cloud TTS API and saves the returned audio locally, with some credential-handling and installation hygiene risks to manage.

Install only if you are comfortable sending the text you synthesize to Volcengine/Doubao. Use a virtual environment, pin dependencies if possible, avoid --break-system-packages, and do not pass DOUBAO_ACCESS_KEY on the command line; use protected environment or secret-management mechanisms instead.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Note
Location
README.md:36
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:36; also referenced by scripts/tts_synthesize.py:25
Vulnerability Type: Unpinned dependency installation from a mutable package index
Risk Level: Low

Vulnerable Code Snippet:

README.md:36

bash
pip install requests

The import-error guidance in scripts/tts_synthesize.py:25 additionally recommends installing the same unpinned package with the --break-system-packages option.

Technical Analysis

The installation documentation identifies the dependency only by its package name. It does not constrain the package to a reviewed version or verify its integrity with a cryptographic hash. Consequently, the installed code depends on the mutable state of the configured Python package index at installation time.

While requests is a legitimate and well-known package and there is no evidence that this project intentionally retrieves a malicious dependency, the lack of version and integrity controls creates supply-chain exposure. A compromised upstream release, package-index account, mirror, or resolver configuration could cause users to install code different from the version reviewed by the project author.

Recommending --break-system-packages further weakens isolation by allowing pip to modify a system-managed Python environment. This can replace or conflict with packages used by other applications on the same host.

Attack Path

  1. An attacker compromises the upstream package distribution channel, a configured package mirror, or the maintainer account for a future dependency release.
  2. A user follows the project documentation and executes pip install requests without a version or hash constraint.
  3. Pip resolves and downloads the attacker-controlled or otherwise compromised release.
  4. Package-controlled installation or runtime code executes with the privileges of the user running pip.
  5. If installation is performed in a privileged or s ...[truncated 678 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a dependency file containing an explicitly reviewed version, such as requirements.txt.
  2. Generate and enforce cryptographic hashes for all resolved packages, for example:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Use a lock file generated by a dependency-management tool so transitive dependencies are also reproducible.
  4. Instruct users to create an isolated virtual environment:
    bash
    python3 -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt
  5. Remove the recommendation to use --break-system-packages.
  6. Periodically review and update the pinned dependency after vulnerability and compatibility testing.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/tts_synthesize.py:263
Finding

Access Token Can Be Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: README.md:101, SKILL.md:74, and scripts/tts_synthesize.py:263,268-269
Vulnerability Type: Sensitive credential accepted through a command-line argument
Risk Level: Medium

Vulnerable Code Snippets:

README.md:101

text
--access-key KEY          Access Key

scripts/tts_synthesize.py:268-269

python
app_id = args.app_id or os.environ.get("DOUBAO_APP_ID")
access_key = args.access_key or os.environ.get("DOUBAO_ACCESS_KEY")

The argument is registered by the parser at scripts/tts_synthesize.py:263, and the Skill documentation explicitly advertises direct credential submission through --access-key.

Technical Analysis

Command-line arguments are not an appropriate transport for long-lived secrets. Depending on the operating system and execution environment, arguments may be exposed through:

  • Shell history files
  • Process inspection tools and process metadata
  • /proc process command-line entries
  • Audit and endpoint-monitoring logs
  • CI/CD job logs
  • Container or orchestration metadata
  • Agent framework execution transcripts

The application does not print the access key itself, and the preferred environment-variable path is available. However, explicitly supporting and documenting --access-key encourages users or automated agents to place the token in a more observable channel.

Attack Path

  1. A user or agent invokes the script with a real token:
    bash
    python3 scripts/tts_synthesize.py --text "Example" --access-key REAL_TOKEN
  2. The complete command is retained in shell history, process metadata, audit logs, an agent transcript, or CI/CD output.
  3. A local user, monitoring operator, log reader, or compromised process obtains access to that record.
  4. The observer extracts the Volcengine access token.
  5. The observer submits authenticated requests to services permitted by the token until it exp ...[truncated 785 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --access-key command-line option and its documentation.
  2. Prefer a secret manager or framework-provided credential facility with access controls and redaction.
  3. If an environment variable remains supported, ensure launch scripts do not log the environment and restrict access to process metadata.
  4. For interactive use, accept the token through a non-echoing prompt such as getpass.getpass() rather than through argv.
  5. Support a permission-restricted configuration file only if required, and validate that its permissions exclude other users.
  6. Configure CI/CD and agent frameworks to redact DOUBAO_ACCESS_KEY from logs and execution traces.
  7. Issue narrowly scoped, short-lived credentials where supported, and rotate any token previously passed on a command line.
  8. Update README.md and SKILL.md to show only the protected credential-loading method.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger language is excessively broad, including everyday phrases like '帮我把这段话读出来' and '生成一段音频', and even states the skill must be used whenever related requests appear. This can cause over-activation and unintentionally send ordinary user content to a third-party cloud service without clear user intent or consent.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

md
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tts_synthesize.py (reported line 79)May include surrounding context.

python
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tts_synthesize.py (reported line 285)May include surrounding context.

python
- name: DOUBAO_APP_ID
      description: 火山引擎控制台获取的 APP ID，用于调用豆包 TTS 云端 API 的身份标识
    - name: DOUBAO_ACCESS_KEY
      description: 火山引擎控制台获取的 Access Token，用于调用豆包 TTS 云端 API 的鉴权密钥
  optional:
    - name: DOUBAO_SPEAKER
      description: 音色 ID，默认为 zh_female_xiaohe_uranus_bigtts（小何 2.0，通用中文女声）

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README instructs users to configure cloud TTS credentials and generate local audio output, but it does not clearly warn that input text will be transmitted to a third-party service and that synthesized audio will be written to disk. In an agent context, users may unknowingly send sensitive text or create persistent files containing sensitive spoken content, creating privacy and data-handling risks.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares no explicit tool scope despite clearly requiring environment-variable access and outbound network access to a cloud TTS API. Without an allowlist such as permissions or allowed-tools, the runtime may grant broader capabilities than necessary, increasing blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description explains how to use the cloud API but does not prominently warn that user text and credentials are sent to an external TTS provider. This creates a privacy and transparency issue because users may provide sensitive text or cloned-voice content without realizing it leaves the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring, usage instructions, and all user-facing help are presented only in Chinese, which imposes a specific language/locale on users. The file does not offer an opt-in language selection or explain that the skill is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.