Security audit

Multi-role TTS Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill’s audio-generation purpose is coherent, but its installer and file-handling behavior need review before installation.

Install only after reviewing install.sh. Prefer manually installing FFmpeg and edge-tts in a virtual environment, avoid running the installer with sudo unless you accept global system changes, and do not submit sensitive scripts to Edge TTS. The included main shell generator also appears broken/truncated, so expect reliability issues.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:107
Finding: Unverified Remote Homebrew Installer Is Downloaded and Executed
Content: View full analysis
/dev/null; then echo -e "${YELLOW}⚠️ Homebrew is not installed; installing it now...${NC}" /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" fi ``` ### Technical Analysis The installer downloads shell code from a mutable remote URL and passes the response directly to `/bin/bash`. The URL belongs to Homebrew's official GitHub repository rather than a personal paste service, but this does not eliminate the underlying risk: - The URL references `HEAD`, so the effective code can change after this Skill has been reviewed. - No version, commit hash, checksum, or cryptographic signature is verified. - The response cannot be inspected before it executes. - Trust is transitively placed in GitHub, the Homebrew repository, DNS, TLS certificate authorities, and the network path. - A failed or compromised upstream response becomes arbitrary local shell code. Installing Homebrew is not strictly required to generate audio. The Skill only needs `ffmpeg` and `edge-tts`, and it could instead stop and provide manual dependency instructions. Automatically bootstrapping an entire package manager exceeds the minimum action necessary for the declared TTS functionality. ### Attack Path 1. A user runs `./install.sh --install` on macOS. 2. The script determines that `brew` is unavailable. 3. The mutable Homebrew installer at the upstream `HEAD` revision is requested. 4. An upstream compromise, account compromise, or network trust failure changes the returned script. 5. The response is immediately executed by `/bin/bash` without integrity verification or user review. 6. The downloaded code obtains the privileges of the invoking user and may request administrative authorization as part of instal ...[truncated 584 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:119
Finding: Mutable and Unverified Python Dependency Installation
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` 3. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Create a dedicated virtual environment instead of modifying the user's global Python environment. 5. Pin and verify all transitive dependencies, not only the top-level package. 6. Avoid unconditional `--upgrade`; upgrades should be a separate, explicit user action. 7. Document the package index being trusted and reject unexpected mirrors unless the user deliberately configured them. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: generate-audio.py:99
Finding: Predictable Intermediate Files Allow Symlink-Based File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (56)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: Environment inspection, temporary file creation, testing of ffmpeg behavior, and execution of external CLIs are not inherently malicious, but they are materially different from the declared purpose and expand the skill's effective attack surface. Undisclosed probing and temp-file activity can surprise users and may interact poorly with restricted or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Environment inspection, temporary file creation, testing of ffmpeg behavior, and execution of external CLIs are not inherently malicious, but they are materially different from the declared purpose and expand the skill's effective attack surface. Undisclosed probing and temp-file activity can surprise users and may interact poorly with restricted or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Environment inspection, temporary file creation, testing of ffmpeg behavior, and execution of external CLIs are not inherently malicious, but they are materially different from the declared purpose and expand the skill's effective attack surface. Undisclosed probing and temp-file activity can surprise users and may interact poorly with restricted or multi-tenant environments.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The cleanup routine deletes files based on a user-controllable output_dir without validating that the directory is safe, expected, and application-owned. An attacker or mistaken user can point output_dir at an arbitrary location and cause destructive deletion of matching files, which is especially risky because shell globbing expands across real filesystem contents.
Content: Scanner excerpt · scripts/multirole-generator-final.sh (reported line 334)May include surrounding context.
sh
if [ "$keep_intermediate" != "1" ]; then echo -e "${BLUE}🧹 清理中间文件...${NC}" rm -f "$output_dir"/*_内容.txt rm -f "$output_dir"/*_原始.mp3 rm -f "$output_dir"/空间版/*.mp3 rm -f "$output_dir"/concat_list.txt

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: This rm command removes *_原始.mp3 from whatever path output_dir references, and output_dir can be supplied by the caller. Without path validation or ownership checks, the script can delete unrelated user files in arbitrary directories that happen to match the pattern.
Content: Scanner excerpt · scripts/multirole-generator-final.sh (reported line 335)May include surrounding context.
sh
if [ "$keep_intermediate" != "1" ]; then echo -e "${BLUE}🧹 清理中间文件...${NC}" rm -f "$output_dir"/*_内容.txt rm -f "$output_dir"/*_原始.mp3 rm -f "$output_dir"/空间版/*.mp3 rm -f "$output_dir"/concat_list.txt rmdir "$output_dir/空间版" 2>/dev/null || true

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Deleting '$output_dir/空间版/*.mp3' is dangerous because the script assumes that subdirectory is safe to clean, but its parent path is externally influenced. If output_dir is redirected to a sensitive location containing a similarly named subdirectory, this can remove legitimate audio files not created by the script.
Content: Scanner excerpt · scripts/multirole-generator-final.sh (reported line 336)May include surrounding context.
sh
echo -e "${BLUE}🧹 清理中间文件...${NC}" rm -f "$output_dir"/*_内容.txt rm -f "$output_dir"/*_原始.mp3 rm -f "$output_dir"/空间版/*.mp3 rm -f "$output_dir"/concat_list.txt rmdir "$output_dir/空间版" 2>/dev/null || true echo -e "${GREEN}✅ 清理完成${NC}"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Although this deletion is narrower than the wildcard cases, it still removes a file in a user-controlled directory path without validating the destination. If output_dir points somewhere unintended, the script can overwrite or delete an existing concat_list.txt belonging to another workflow.
Content: Scanner excerpt · scripts/multirole-generator-final.sh (reported line 337)May include surrounding context.
sh
rm -f "$output_dir"/*_内容.txt rm -f "$output_dir"/*_原始.mp3 rm -f "$output_dir"/空间版/*.mp3 rm -f "$output_dir"/concat_list.txt rmdir "$output_dir/空间版" 2>/dev/null || true echo -e "${GREEN}✅ 清理完成${NC}" else

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file states that the skill integrates with Microsoft Edge TTS, which implies dialogue text may be sent to an external service for speech generation. The description does not warn users that their input content could leave the local system or have privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README promotes Edge TTS-based audio generation but does not disclose that user-provided text may be transmitted to an external TTS service for processing. This creates a privacy and data-handling risk, especially if users input sensitive dialogue, internal data, or regulated content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README instructs users to run an installation script and install dependencies from the network, but it does not clearly warn that these steps modify the local system and rely on external package sources. That omission can cause users to execute privileged or system-changing operations without informed consent, increasing supply-chain and operational risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation and metadata declare installation steps and operational behavior that require shell execution plus local file reads/writes, but it does not declare an explicit tool/permission scope. That mismatch can cause users or orchestration systems to grant capabilities implicitly without informed consent, increasing the chance of unintended command execution or filesystem changes.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation claims the package is clean and neutral after removing sexual content, yet the included example remains sexually suggestive and psychologically manipulative. That inconsistency is a trust and safety issue because it disguises the actual use pattern of the skill and may bypass content review expectations.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README-EN.md (reported line 95)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README-EN.md (reported line 96)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README-EN.md (reported line 102)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 115)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 116)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 122)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/usage-guide.md (reported line 174)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/usage-guide.md (reported line 240)May include surrounding context.
brew install ffmpeg

安装ffmpeg (Ubuntu/Debian)

sudo apt install ffmpeg

text
### **基本使用**：

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes generating audio with Edge TTS but does not clearly warn that user-provided dialogue text is sent to an external service. This creates a privacy and data-handling risk, especially if users input sensitive scripts, personal data, or confidential conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language documentation states support for Chinese voices and repeatedly defines the script format, examples, and configuration around Chinese-only usage. Because the skill is described as a "universal professional tool," this reads as a locale constraint without user opt-in or a clearly justified region-specific limitation.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The example dialogue and best-practice guidance normalize trust-based psychological influence and intimacy cues as desirable interaction patterns. In context, this is not a code-execution flaw, but it is a safety vulnerability because it can encourage harmful manipulation-oriented content generation under the guise of a neutral productivity tool.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Missing User Warnings

Missing User Warnings

Missing User Warnings

Undeclared Tool Scope

Intent-Code Divergence

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Sudo/Root Execution

安装ffmpeg (Ubuntu/Debian)

Missing User Warnings

Natural-Language Policy Violations

Ssd 4

Static analysis