Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly coherent for voice cloning and TTS, but it handles API credentials and user images in a way that needs careful review before installation.
Install only if you understand that the skill may download public speech, create synthetic voice audio, and upload selected images or descriptions to Noiz. Use it only with consent or clearly permissible public-figure/media cases, avoid deception, pin dependencies where possible, and do not use or expose the --base-url option unless you fully trust the endpoint.
scripts/voice_design.py:63Credentials and User Images Can Be Sent to an Arbitrary API Endpoint
SKILL.md:43Unpinned Third-Party Package Installation Creates a Mutable Supply-Chain Risk
The declared description presents a broad end-user capability: automatically find speech online, derive a voice sample, and generate spoken replies in that person's voice, including from an uploaded image. The supplied code chunk is much narrower. It is a local preprocessing utility that selects a likely good voice-reference segment from an existing audio/video file using SRT subtitles and extracts that segment with ffmpeg. It does not implement chatting, persona interaction, voice cloning/synthesis, reply generation, image analysis, or any network activity. While reference-sample extraction is related to the larger described workflow, this chunk by itself does not accurately represent the declared primary purpose and omits several major advertised capabilities.
The description claims a multi-step conversational voice impersonation workflow: automatically finding speech online, extracting a usable voice sample, and generating spoken replies in that voice, with image-based voice matching as an additional feature. The code shown only implements the image/text-description voice-design portion via a remote API. It accepts an image or voice description, submits them to Noiz, receives preview voices, saves WAV previews, and stores a chosen voice_id. That partially overlaps with the 'supports generating a matching voice from an uploaded image' claim, but it does not implement the core declared functionality around chatting, persona roleplay, online speech discovery, sample extraction, or reply synthesis. Permissions used (network, filesystem) are consistent with the declaration, but the primary purpose is materially narrower and different from the full declared behavior.
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The open-ended trigger phrase 'or similar' makes activation boundaries ambiguous, which can cause the agent to invoke a high-risk voice-cloning/impersonation workflow for loosely related requests. In this context, broad triggering is more dangerous because the skill has network and filesystem permissions and facilitates synthetic voice generation for real people.
The activation guidance is written entirely around Chinese phrases such as "我想跟xxx聊天" and "你来扮演xxx跟我说话" without saying the skill also supports other languages or that Chinese-only activation is intentional. This is a natural-language locale constraint that may violate language-choice policy when not presented as opt-in or region-specific.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"-ac", "1",
output_path,
]
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
raise RuntimeError(
f"ffmpeg failed (exit {result.returncode}):\n{result.stderr}"
The manifest describes a skill for finding/generating voices and chatting in-character, but this helper script also implements credential discovery by reading NOIZ_API_KEY from the process environment and a dotfile in the home directory. Accessing ambient credentials is not part of the user-facing purpose and is an additional capability beyond straightforward voice-design processing.
No suspicious patterns detected.