ClawHub
Back to skill

Security audit

tts

Security checks across malware telemetry and agentic risk

Overview

This text-to-speech skill is mostly coherent, but it deserves review because it can fetch arbitrary reference-audio URLs and upload text or voice samples to a cloud TTS service.

Review before installing if your agent has access to internal networks or sensitive files. Use the local Kokoro backend for private text or voice samples, avoid reference-audio URLs unless they are trusted public media files, and do not use cloud voice cloning for recordings you are not authorized to upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The code accepts arbitrary http/https URLs for reference_audio and fetches them server-side. This enables SSRF-style behavior, allowing a user to make the host contact arbitrary internal or external endpoints and store the response as a local file, which is more dangerous in a skill that already has network and filesystem permissions.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The top-level description includes very broad triggers such as 'speak', 'say', and 'voice', which can match ordinary conversation unrelated to TTS. In an agent environment, this can cause unintended skill invocation, leading to unnecessary file/network access and accidental transmission of user content to external TTS services.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The Triggers section repeats ambiguous keywords without scope constraints, increasing the chance the agent activates the skill for general speech-related requests rather than explicit text-to-audio tasks. Because the skill has both filesystem and network permissions, accidental invocation can expose local content or send text/reference audio to remote services without clear user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
When --reference-audio is used, the script uploads a local audio file to a remote API for voice cloning without any explicit consent prompt or warning at the point of transmission. Because reference audio can contain sensitive biometric voice data or private recordings, silent upload increases privacy and compliance risk, especially in an agent setting where users may not realize local files are being sent off-device.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.