ClawHub
Back to skill

Security audit

MiniMax TTS Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real MiniMax text-to-speech helper, but it needs Review because an undocumented host override and unrestricted output paths can expose API keys/text or overwrite files.

Review before installing. Use a dedicated MiniMax TTS key, make sure MINIMAX_API_HOST is unset or points only to an endpoint you explicitly trust, avoid sending sensitive text, and choose output paths inside a safe workspace because existing files can be overwritten.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f.write(f"file '{tf}'\n")

                if audio_format == 'mp3':
                    subprocess.run(
                        ['ffmpeg', '-y', '-f', 'concat', '-safe', '0', '-i', concat_file,
                         '-codec:a', 'libmp3lame', '-q:a', '2', final_path],
                        check=True, capture_output=True
Confidence
86% confidence
Finding
The code invokes ffmpeg on a concat file built from generated temporary filenames while using ffmpeg's concat demuxer with '-safe 0'. Although subprocess.run is used without a shell, the concat input format is still interpreter-controlled by file contents, so malformed or specially crafted paths can cause ffmpeg to read unintended files or behave unexpectedly during merging.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
check=True, capture_output=True
                    )
                else:
                    subprocess.run(
                        ['ffmpeg', '-y', '-f', 'concat', '-safe', '0', '-i', concat_file, final_path],
                        check=True, capture_output=True
                    )
Confidence
85% confidence
Finding
This second ffmpeg invocation has the same risk profile: no shell injection is present, but ffmpeg is still being asked to process a concat manifest whose contents may be unsafe, with '-safe 0' disabling path safety checks. That can enable unintended file access or processing if an attacker can influence temp filenames or the working environment.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill clearly requires an API key, invokes a Python script, writes audio files, and sends data to an external MiniMax service, yet the finding indicates these capabilities are not explicitly declared as permissions. Undeclared network/file/env/shell capabilities reduce transparency and can bypass user expectations or policy controls, especially because user-provided text and local output paths are involved.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation describes TTS generation with the MiniMax API but does not prominently warn that the user's input text is transmitted to a third-party service for processing. This creates a privacy and data-handling risk because users may submit sensitive text, scripts, or articles without realizing that content leaves the local environment.

Unvalidated Output Injection

High
Category
Output Handling
Content
f.write(f"file '{tf}'\n")

                if audio_format == 'mp3':
                    subprocess.run(
                        ['ffmpeg', '-y', '-f', 'concat', '-safe', '0', '-i', concat_file,
                         '-codec:a', 'libmp3lame', '-q:a', '2', final_path],
                        check=True, capture_output=True
Confidence
83% confidence
Finding
The ffmpeg command writes to a user-controllable final_path without validation, enabling arbitrary file overwrite in the privileges of the running process. Combined with automatic directory creation and '-y', this can clobber existing files if an attacker can supply output_path.

Unvalidated Output Injection

High
Category
Output Handling
Content
check=True, capture_output=True
                    )
                else:
                    subprocess.run(
                        ['ffmpeg', '-y', '-f', 'concat', '-safe', '0', '-i', concat_file, final_path],
                        check=True, capture_output=True
                    )
Confidence
83% confidence
Finding
This alternate ffmpeg path has the same arbitrary file overwrite risk through final_path. Even without shell injection, allowing unvalidated output destinations can be abused to overwrite user files or application data.

Static analysis

No suspicious patterns detected.