iFlytek Ultra-Realistic TTS

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:46 AM UTC
• Version: 1.0.0

Overview

This TTS skill does what it claims, but its WebSocket client disables TLS certificate and hostname checks while sending user text and API-authenticated requests.

Install only if you are comfortable sending requested text to iFlytek and storing generated audio locally. Do not use it for secrets, regulated data, or confidential text unless the TLS validation issue is fixed by removing the certificate and hostname verification overrides.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tts.py:66

Finding

TLS Certificate and Hostname Verification Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/tts.py, lines 66–70
Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code

python

if parsed.scheme == "wss":
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    self._sock = ctx.wrap_socket(raw, server_hostname=host)

Technical Analysis

The WebSocket client creates a TLS context but explicitly disables hostname verification and certificate-chain validation. Consequently, the client accepts any certificate presented during a wss:// connection, including a self-signed or attacker-controlled certificate.

This affects the connection to the documented iFlytek TTS endpoint. The request carries a signed authorization URL containing the API key and HMAC signature, as well as the user-supplied text encoded with Base64. Base64 is only transport encoding and provides no confidentiality.

The Base64 encoding itself is necessary for the documented TTS protocol and does not appear to be a covert exfiltration channel. Sending user-supplied text to the disclosed cloud TTS endpoint is consistent with the Skill's declared functionality. However, disabling TLS validation is unnecessary and defeats the security expected from that connection.

Attack Path

1. A user invokes the Skill to synthesize sensitive or private text.
2. An attacker obtains a network interception position, such as through a malicious Wi-Fi access point, compromised proxy, DNS manipulation, or network-routing attack.
3. The attacker redirects or intercepts the connection to the iFlytek hostname.
4. The attacker presents an arbitrary TLS certificate.
5. Because certificate-chain and hostname validation are disabled, the client accepts the attacker's certificate.
6. The client sends the authenticated WebSocket request, including the API key, time-limited signature, application identifier, synthesis settings, and Base64-encoded plaintext ...[truncated 699 chars]

Remediation

View remediation

Remediation Suggestions

1. Preserve the secure defaults from ssl.create_default_context():

python

if parsed.scheme == "wss":
    ctx = ssl.create_default_context()
    self._sock = ctx.wrap_socket(raw, server_hostname=host)

2. Do not set check_hostname to False or verify_mode to ssl.CERT_NONE.
3. Ensure the runtime has an up-to-date trusted CA bundle. If a private CA is legitimately required, load only that CA explicitly rather than disabling validation globally.
4. Validate the complete WebSocket upgrade response, including the HTTP status and Sec-WebSocket-Accept value derived from the client nonce, before transmitting credentials or user text.
5. Fail closed on any certificate, hostname, handshake, or protocol validation error.
6. Consider certificate pinning only if the provider publishes and maintains a supported pinning policy; otherwise, standard platform trust validation is preferable.
7. Document that submitted text is sent to the third-party TTS provider so users can avoid transmitting content unsuitable for external processing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The WebSocket client uses TLS for a credentialed outbound connection, but explicitly disables hostname verification and certificate validation before wrapping the socket. That allows a man-in-the-middle attacker to impersonate the TTS endpoint, intercept signed requests and synthesized content, and tamper with responses while the client believes it is securely connected.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Disabling certificate validation on the outbound wss:// connection removes the authenticity guarantees of TLS. In this skill, the connection carries API-authenticated traffic and user-provided text, so an active network attacker could redirect the client to a rogue server, observe sensitive content, and return malicious or misleading audio payloads.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation advertises behavior that uses environment variables, reads local files, and sends content over the network, but it does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations can lead to the skill being invoked with broader-than-expected access and without clear user/admin review of sensitive capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The description says to use the skill whenever a user wants to convert text to speech, generate audio narration, or create voice content, which is broad enough to match many generic requests. Overly broad activation criteria increase the chance of unintended invocation, causing user text to be sent to a third-party service and written to disk without sufficiently specific intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explains how to synthesize speech but does not prominently warn that provided text is transmitted to iFlytek's remote WebSocket API and that resulting audio is saved to a local file. This can cause accidental disclosure of sensitive or regulated text content to a third party and unexpected persistence of generated output on the local system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Natural-language strings and defaults emphasize Chinese/Chinese-locale voices, and the built-in voice list is primarily localized around Chinese language variants without any stated opt-in or locale-selection policy. This can be read as forcing a specific language/locale orientation rather than explicitly offering the user a neutral language choice.

Content

No source excerpt is available for this finding.