ClawHub
Back to skill

Security audit

Characteristic Voice

Security checks for vulnerabilities and agentic risk

Overview

This voice-generation skill is not plainly malicious, but it needs review because it can upload speech text and voice samples to a third-party service and its activation scope is broad.

Review before installing. Use this only for explicit audio-generation tasks, prefer the Kokoro backend for private speech, and only provide reference audio when you have consent and rights to use that voice. Be aware that Noiz mode sends text and reference audio to a third-party service and that the skill saves a local API key if configured.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/speak.sh:284
Finding

Sensitive speech text may persist after local TTS failure

Content
View full analysis

Vulnerability Details

File Location: scripts/speak.sh:284-295
Vulnerability Type: Incomplete temporary-file cleanup
Risk Level: Medium

Vulnerable Code

bash
if [[ "$detected" == "kokoro" ]]; then
  input_path="$(mktemp /tmp/tts_input_XXXXXX.txt)"
  printf '%s' "$text" > "$input_path"

  cmd=(kokoro-tts "$input_path" "$output" --format "$format")
  [[ -n "$voice" ]] && cmd+=(--voice "$voice")
  [[ -n "$lang" ]]  && cmd+=(--lang "$lang")
  cmd+=(--speed "$speed")

  "${cmd[@]}"
  rm -f "$input_path"
  exit 0
fi

Technical Analysis

The Kokoro backend writes the complete user-supplied speech text to a temporary file. Although mktemp provides an unpredictable name and generally creates the file with restrictive permissions, cleanup occurs only after kokoro-tts completes successfully.

Because the script enables set -e, a nonzero exit from kokoro-tts terminates the script before rm -f "$input_path" executes. Process interruption or termination can produce the same result. No trap is registered to provide cleanup on error or signal.

The temporary file is therefore not inherently unsafe at creation time, but its lifecycle is not failure-safe. Speech input can include confidential or personal information and may remain as plaintext under /tmp after an unsuccessful invocation.

Attack Path

  1. A user invokes the Skill with sensitive text and selects or automatically reaches the Kokoro backend.
  2. The script writes the complete text to /tmp/tts_input_XXXXXX.txt.
  3. kokoro-tts fails, is interrupted, or is deliberately terminated before returning successfully.
  4. Due to set -e, the script exits before executing the explicit removal command.
  5. The plaintext file remains on disk.
  6. An actor who later obtains sufficient local access, or a privileged diagnostic, backup, or forensic process, can recover the speech content.

This does not directly grant elevated privileges. Exploitation requires local access compatibl ...[truncated 572 chars]

Remediation
View remediation

Remediation Suggestions

Register cleanup immediately after creating the temporary file so it runs during normal exit, command failure, and common termination signals:

bash
if [[ "$detected" == "kokoro" ]]; then
  input_path="$(mktemp "${TMPDIR:-/tmp}/tts_input_XXXXXX.txt")"
  cleanup_input() {
    rm -f -- "$input_path"
  }
  trap cleanup_input EXIT HUP INT TERM

  printf '%s' "$text" > "$input_path"

  cmd=(kokoro-tts "$input_path" "$output" --format "$format")
  [[ -n "$voice" ]] && cmd+=(--voice "$voice")
  [[ -n "$lang" ]]  && cmd+=(--lang "$lang")
  cmd+=(--speed "$speed")

  "${cmd[@]}"

  cleanup_input
  trap - EXIT HUP INT TERM
  exit 0
fi

Additional hardening should include:

  • Respecting ${TMPDIR:-/tmp} rather than hardcoding /tmp.
  • Explicitly applying restrictive permissions with chmod 600 "$input_path" as defense in depth.
  • Avoiding disk-backed plaintext entirely if kokoro-tts supports standard input, pipes, or secure file descriptors.
  • Documenting that local processing can temporarily place speech text on disk.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
The included `speak.sh` script requires **curl** and **python3** at runtime. Depending on which backend and features you use, you may also need:

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
The included `speak.sh` script requires **curl** and **python3** at runtime. Depending on which backend and features you use, you may also need:

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

md
2. **Mirror energy** — gentle when they're low, match when they're high
3. **Keep it brief** — 1–3 sentences, like a voice message from a friend
4. **End warmly** — close with connection ("I'm here", "see you tomorrow~")
5. **Don't lecture** — listen and stay present; no unsolicited advice

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly instructs use of shell commands and an included script, but it does not declare any tool scope or allowed-tools constraints. That makes the agent's execution surface implicit rather than bounded, increasing the risk of unintended shell access or misuse of external commands during invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The top-level description uses broad phrases like 'say like', 'talk like', and 'comfort me' that can match many ordinary requests. Overbroad triggers can cause the skill to activate in contexts where personality styling or voice-cloning behavior was not intended, leading to inappropriate tool use or unnecessary data handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The listed triggers are short and ambiguous, with little scope constraint or exclusion guidance. In an agent setting, this can create accidental invocation and route benign conversation into a shell-backed skill that may save keys, use local files, or contact a remote backend.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill goes beyond expressive TTS and provides a workflow for obtaining third-party audio from online sources for voice cloning. Even with warnings, this expands the skill into downloading, extracting, and reusing others' voices, which introduces privacy, consent, copyright, and impersonation abuse risks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/speak.sh (reported line 77)May include surrounding context.

sh
local normalized
  normalized="$(normalize_api_key_base64 "$1")"
  printf '%s' "$normalized" > "$NOIZ_KEY_FILE"
  chmod 600 "$NOIZ_KEY_FILE"
}

normalize_api_key_base64() {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script supports --ref-audio and uploads the provided file to the remote Noiz API via curl -F "file=@$ref_audio", but it does not present any explicit warning or consent gate about sending biometric voice data off-device. In a voice-cloning context, reference audio is especially sensitive because it can identify a person and enable impersonation, so silent transmission increases privacy and misuse risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.