T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tts_walkie.sh:27- Finding
Arbitrary Command Execution Through Unquoted Heredoc Expansion
- Content
View full analysis
- Remediation
View remediation
Security audit
KittenTTS WhatsApp
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent audio purpose, but its install instructions and scripts create avoidable system-wide and code-execution risks.
Review this skill carefully before installing. Use a virtual environment, pin and verify dependencies, avoid --break-system-packages where possible, do not run the runtime scripts as root, avoid storing tokens in ~/.bashrc unless you accept that persistence, and fix the heredoc/input handling and temporary-file usage before processing untrusted text or audio.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tts_walkie.sh:11- Finding
Predictable Temporary Paths Permit Symlink and File-Clobbering Attacks
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:55- Finding
Unpinned Packages Are Installed Into the System Python Environment
- Content
View full analysis
> ~/.bashrc ``` The optional transcription instructions similarly state: ```bash # Install whisper (one-time, ~140MB-1.4GB depending on model) pip3 install whisper --break-system-packages bash scripts/transcribe.sh /path/to/audio.ogg [model] ``` ### Technical Analysis The installation commands retrieve Python packages without pinned versions or verified hashes. Consequently, the code installed for the same documented command can change after the skill has been reviewed. Package installation can execute build-system and installation logic, so a compromised registry account, malicious release, or unsafe transitive dependency could execute code during installation. The `--break-system-packages` option bypasses protections intended to prevent `pip` from modifying a distribution-managed Python environment. This can replace or conflict with packages required by operating-system tools and other applications. The package name `whisper` is also ambiguous relative to the commonly intended OpenAI Whisper distribution. The documentation does not establish the publisher, exact release, artifact hash, or verified source. Installing a similarly named or unintended distribution creates package-confusion risk. The audit found no evidence that the currently intended dependencies are malicious. The finding concerns the unsafe, mutable installation mechanism and insufficient dependency identity verification. ### Attack Path 1. An administrator follows the documented setup instructions, potentially using a privile ...[truncated 987 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
| 80M | 80MB |
KittenML/kitten-tts-mini-0.8|Default:
kitten-tts-mini-0.8(best quality). Change inscripts/tts_walkie.sh.Setup
Run these manually before the skill is used:
bash # 1. System package (requires root/privileged) apt-get install -y ffmpeg # 2. Python package pip3 install kittentts --break-system-packages # 3. Optional: set Hugging Face token to avoid rate limits # echo 'export HF_TOKEN="hf_your_token_here"' >> ~/.bashrcRestart OpenClaw after installing dependencies so the new packages are in PATH.
Usage
TTS only (no transcription)
bash bash scripts/tts_walkie.sh "Your message here" Bella # Output: /tmp/walkie_reply.ogg (16kHz OGG Opus, WhatsApp-ready)Transcription only (optional — requires whisper)
bash # Install whisper (one-time, ~140MB-1.4GB depending on model) pip3 install whisper --break-system-packages bash scripts/transcribe.sh /path/to/audio.ogg [model] # Model: tiny | base | small | medium | large (defaul
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## ⚠️ Privileged Install Warning The dependency install commands use `--break-system-packages` and `apt-get install -y`. These require root privileges and modify system packages. Review before running if you are on a managed system. ## Troubleshooting
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The whisper invocation hard-codes
--language en, which imposes an English-only locale choice regardless of the input audio or user preference. This is a natural-language policy concern because it restricts language handling without offering opt-in, configurability, or a documented region-specific justification.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh # Create private temp dir (mode 700) mkdir -p "$TMP_DIR" chmod 700 "$TMP_DIR" echo "[TTS] Generating: $TEXT" echo "[TTS] Voice: $VOICE, Speed: $VOICE_SPEED"