ClawHub
Back to skill

Security audit

Sapi Tts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Windows text-to-speech helper that saves generated audio locally and only suggests an optional third-party voice adapter.

Before installing, remember that generated audio files may contain the text you spoke and will be stored locally by default. The optional neural-voice adapter is third-party software from GitHub; install it only if you trust that project and can verify the downloaded release.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:203
Finding
Unpinned Third-Party SAPI Adapter Installation Recommendation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 203–207 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown For additional Neural voices (like French Denise): 1. Install [NaturalVoiceSAPIAdapter](https://github.com/gexgd0419/NaturalVoiceSAPIAdapter) 2. Download voices in **Settings → Time & Language → Speech** 3. Run `-ListVoices` to verify ``` ### Technical Analysis The installation instructions recommend obtaining and installing a third-party SAPI adapter from a mutable GitHub repository. They do not pin a reviewed release or commit, specify an expected SHA-256 digest, require digital-signature verification, or provide guidance for validating the publisher and downloaded artifact. Consequently, the dependency retrieved by a user may differ from the version available when this Skill was audited. Compromise of the repository, maintainer account, release workflow, or distributed installer could turn this optional installation step into a supply-chain execution vector. The audited PowerShell code does not itself download or execute this dependency, so exploitation requires a user to follow the optional installation recommendation. ### Attack Path 1. An attacker compromises the referenced repository, its maintainer account, release process, or downloadable installation artifact. 2. The attacker publishes a modified adapter or installer containing malicious code. 3. A user follows the instructions in `SKILL.md` and downloads the dependency without a pinned version or integrity verification. 4. The user installs or executes the altered component. 5. The malicious code runs with the privileges granted to the installer or current user. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing user's security context. Depending on the installer privileges and user approval, the affected scope may include access to user files, modifi ...[truncated 349 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Clearly identify the adapter as an optional third-party component that is not required for the built-in SAPI5 functionality. 2. Pin the recommendation to a specific reviewed release and immutable commit identifier. 3. Link to an official release artifact rather than only to the mutable repository homepage. 4. Publish the expected SHA-256 digest and provide a PowerShell verification command, such as: ```powershell Get-FileHash -Algorithm SHA256 .\downloaded-installer.exe ``` 5. Require users to verify the artifact's Authenticode signature and expected publisher before execution: ```powershell Get-AuthenticodeSignature .\downloaded-installer.exe ``` 6. Document the permissions required by the installer and advise against administrative execution unless it is demonstrably necessary. 7. Periodically review the pinned upstream release and update the version and integrity metadata through a controlled audit process. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
The embedded script sets `-Language` to `fr` by default, which forces a specific locale behavior when the user does not choose one. The skill description also presents French as the default without explaining or justifying that locale preference as region-specific.

Missing User Warnings

Low
Confidence
95% confidence
Finding
This markdown file embeds a script that automatically creates a directory under the user's profile and saves generated audio there when no output path is provided. The surrounding skill description explains how to use the feature but does not clearly warn users that audio content will be persisted locally by default.

Static analysis

No suspicious patterns detected.