daily-news-caster

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:53 AM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent, but its voice-cloning path can send podcast text and user-provided voice recordings to a third-party TTS service without requiring explicit confirmation.

Review this skill before installing if you plan to use custom or cloned voices. Only provide reference recordings when every speaker has authorized that use, and confirm which TTS backend will receive the script and audio before generation. Standard news fetching and non-cloned audio generation are lower risk.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:64

Finding

Third-Party Disclosure of Podcast Text and Biometric Voice Data Without Explicit Consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 64–71; supporting disclosure at lines 96–99
Vulnerability Type: other: Sensitive Data Disclosure
Risk Level: Medium

Vulnerable Code

markdown

**1. Generate Audio for Each Line**:
For each dialogue line in the script, run the `speak` command. Use the appropriate voice or reference audio for the respective host. If the user provided reference audio files for the two roles, use them via the `--ref-audio` flag (requires noiz backend and `NOIZ_API_KEY`). Without an API key, guest mode voices are available (see tts SKILL.md for the voice list).
```bash
python3 skills/tts/scripts/tts.py -t "Welcome to today's news roundup..." --ref-audio host_A.wav -o line_01.wav

python3 skills/tts/scripts/tts.py -t "The main takeaway is that..." --ref-audio host_B.wav -o line_02.wav

text

The security disclosure confirms the external service behavior:

```markdown
- **Credentials**: This skill does not require any API keys or environment variables directly. The `tts` dependency may require `NOIZ_API_KEY` for voice-cloning features (noiz backend); without it, guest-mode voices work out of the box. See the tts skill's SKILL.md for details.
- **Network access**: All network calls are made by the dependency skills, not by this skill's instructions. The news-aggregator fetches from public news sources; the tts skill contacts `noiz.ai` only when the noiz backend is used.
- **Files written**: `podcast_script.md`, `line_*.wav` (temporary per-sentence audio), `list.txt` (ffmpeg concat list), `podcast_output.wav` (final output). All are written to the current working directory.
- **No persistent state**: This skill does not write configuration files, store credentials, or modify other skills.

Technical Analysis

The workflow instructs the agent to pass each podcast dialogue line and optional user-provided reference recordings to the TTS dependency. The document ...[truncated 2759 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed opt-in immediately before invoking any network-backed TTS service. Clearly identify noiz.ai and enumerate the text and audio that will be transmitted.
2. Default to local or non-cloning speech synthesis. Use --ref-audio only when the user specifically requests voice cloning and confirms authorization from every recorded speaker.
3. Present a privacy warning covering third-party processing, possible retention, provider logging, and applicable deletion options before uploading reference audio.
4. Provide a preview of the exact script and reference files selected for transmission and allow the user to approve or remove them.
5. Minimize uploaded data by trimming recordings to the shortest necessary sample, stripping unnecessary metadata, and excluding unrelated script content.
6. Do not claim or imply that sentence-by-sentence generation protects the script from disclosure; document that all submitted lines are externally processed.
7. Constrain network permission to the selected backend and only for the duration of synthesis, rather than treating broad network access as an unconditional workflow requirement.
8. Review and pin the tts dependency, verify its actual endpoints and transport security, and document the provider's retention, training, and deletion policies.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill embeds Chinese text '(言简意赅)' in the core writing instructions, which introduces a language-specific requirement into the skill's natural-language behavior. The file does not state that the user opted into Chinese or that multilingual output is intentional, so this can conflict with a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.