文字转语音/Text to Audio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent text-to-speech tool, but it automatically installs an unpinned package and sends text to an online Microsoft TTS service, so users should review it before installing.

Install only if you are comfortable using an online TTS service for the text you provide. Run it in a virtual environment, install a pinned reviewed version of edge-tts yourself, and avoid sending confidential, regulated, or private text unless that cloud processing is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/check_env.py:32

Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Remediation

View remediation

" ``` 2. Maintain a lock or requirements file containing exact versions for `edge-tts` and all transitive dependencies. 3. Require cryptographic hashes during installation: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Configure an explicitly trusted package index or an internally controlled package mirror. 5. Require an isolated virtual environment and avoid modifying system-wide Python installations. 6. Ask for explicit user confirmation before installing dependencies. Prefer making `check_env.py` diagnostic-only and provide a separate, documented installation command. 7. Separate dependency verification from network checks and report the exact package version and source being used. 8. Add automated dependency scanning and periodically review pinned versions before updating the lock file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior expands beyond simple text-to-speech into automatic dependency installation and external connectivity checks, while also failing to clearly prove that audio generation is the only outcome. This mismatch can mislead users and orchestrators about what the skill will actually execute, enabling unexpected code execution, network activity, and data handling outside the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requires file access, shell execution, and network use, but does not declare any tool scope or permissions boundaries. This creates an implicit trust issue: an agent may invoke powerful capabilities without clear user-visible constraints, increasing the risk of unintended file reads, package installation, or external network access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are overly broad and can cause the skill to activate for many generic reading, narration, image, or text requests outside a narrowly intended TTS workflow. Overbroad activation increases the chance that sensitive text or images are routed into this skill and then sent to external services or processed with shell/network capabilities without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states it uses Microsoft's online TTS service but does not clearly warn that user-provided or OCR-extracted text will be transmitted to an external cloud provider. This is a privacy and compliance risk, especially if users submit personal, educational, confidential, or copyrighted material believing processing is local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill is advertised for TTS, but the check script escalates its capability by spawning pip and altering the runtime environment. That mismatch increases supply-chain and integrity risk because running the skill can fetch and execute external package code unrelated to the immediate user request.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The script invokes pip via subprocess to modify the local environment, which is a privileged side effect beyond simple text-to-speech functionality. Even though the command is hard-coded and not shell-injected, automatic package installation can introduce unreviewed code from package indexes and changes the host system without explicit approval.

Content

Scanner excerpt · scripts/check_env.py (reported line 40)May include surrounding context.

python

def install_edge_tts():
    """安装 edge-tts"""
    print("Installing edge-tts...")
    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", "edge-tts"],
        capture_output=True, text=True
    )

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script's natural-language descriptions and logic explicitly target Chinese TTS voices only, filtering locales to zh-CN. This enforces a specific language/locale behavior without any visible user choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The main flow automatically attempts installation when edge-tts is absent, without any user confirmation or approval gate. Silent dependency installation weakens user control and can unexpectedly modify environments, especially on shared, production, or restricted systems.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file description and implementation present the skill as supporting only Chinese and English voices, and the language detection logic later hard-classifies text as either "zh" or "en". This is a natural-language locale constraint without an explicit user opt-in or documented justification for restricting the skill to those languages.

Content

No source excerpt is available for this finding.