Multi-role TTS Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 2:26 AM UTC
• Version: 1.0.1

Overview

This appears to be a real multi-role TTS tool, but it needs review because installation makes privileged system changes and user dialogue text is sent to a network TTS service without clear privacy guidance.

Review install.sh before installing. Prefer installing ffmpeg and edge-tts yourself, avoid running the Homebrew curl-to-bash path unless you trust it, and do not submit private, regulated, or proprietary dialogue text to this skill unless use of Microsoft Edge TTS is acceptable. Also expect reliability issues because the bundled shell generator appears incomplete; the Python generator is the more coherent entry point.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 使用ffmpeg合并
        print("合并音频...")
        result = subprocess.run([
            'ffmpeg', '-f', 'concat', '-safe', '0',
            '-i', merge_list, '-c', 'copy', output_file
        ], capture_output=True, text=True)

• Confidence: 84% confidence
• Finding: The code invokes ffmpeg on a concat list built from filenames without escaping or sanitizing the entries, and explicitly uses '-safe 0', which relaxes ffmpeg's path safety checks. If an attacker can influence temporary filenames or working-directory contents, this can cause ffmpeg to read unintended files or process attacker-controlled paths, making the external-tool invocation materially risky in this context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation advertises shell execution, file reads, and file writes, but the manifest does not declare corresponding permissions. That creates a transparency and least-privilege problem: users and platforms cannot accurately assess what the skill needs before running it, increasing the chance of unexpected local file access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose is audio generation, but the behavior described by analysis includes system package installation, sudo use, modifying system directories, creating symlinks, self-copying into skill directories, and uninstall logic that deletes files. This mismatch is dangerous because users may authorize a seemingly harmless media tool without realizing it can make privileged, persistent system changes.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script executes `source "$CONFIG_DIR/config.sh"`, which runs arbitrary shell code from an external file rather than parsing passive configuration data. Because the sourced file sits outside the script and is loaded automatically when present, anyone who can modify that config gains code execution in the context of the user running the skill.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes Microsoft Edge TTS integration, which implies user-provided dialogue text may be sent to an external service, but it provides no privacy notice, data handling caveat, or guidance against submitting sensitive content. In a skill designed for generating conversations that may include customer service, counseling, education, or personal reminders, this omission can lead users to unknowingly expose private or regulated information to a third party.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The README encourages use of Edge TTS but does not disclose that user-provided text may be transmitted to an external service for synthesis. In a tool designed to generate dialogue audio, users may input sensitive, proprietary, or personal text, so the lack of a privacy warning can lead to unintended data exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill sends user-supplied dialogue to an external TTS service, but the documentation does not clearly warn users about this data transfer. This is dangerous because users may input sensitive scripts, names, or private conversations without understanding that the content leaves the local environment and may be processed by a third party.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The guide shows commands that write an output file without warning that an existing file at the same path may be overwritten. In practice this can cause accidental data loss or clobber important local files if users reuse filenames or script paths carelessly.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation mentions that Edge TTS requires network access but does not clearly disclose that submitted script text may be transmitted to and processed by a remote third-party service. Users may unknowingly send sensitive dialogue, personal data, or proprietary content off-device, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script executes a shell script fetched directly from GitHub via curl and pipes it into bash, which creates a classic remote code execution trust boundary failure. If the remote content, transport, or referenced source is compromised, arbitrary code will run on the user's machine during installation, and the lack of an explicit confirmation step increases the chance of unsafe execution.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The installer copies the entire current directory into a privileged OpenClaw skills path and changes permissions using sudo without an explicit prompt describing the system modifications. This can unintentionally install extra files from the working directory and broadens the consequences of running the installer from an untrusted or cluttered location.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The uninstall path performs recursive deletion with sudo and no confirmation before removing the installed directory. Although the path is hardcoded, destructive privileged deletion without user confirmation increases the chance of accidental data loss or misuse if path assumptions change.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends the full text content of each role to `edge-tts`, which is a network-backed text-to-speech service, without clearly warning the user that their script contents may leave the local machine. If users process private conversations, proprietary scripts, or sensitive data, this can cause unintended data disclosure.

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.