T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:16- Finding
Mutable and Unverified Third-Party Components Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
CosyVoice3 macOS
Security checks for vulnerabilities and agentic risk
Overview
This TTS skill is mostly purpose-aligned, but its installer runs mutable third-party code and downloads unverified components, so users should review it before installing.
Install only if you are comfortable trusting Anaconda, GitHub CosyVoice code and submodules, PyPI/PyTorch packages, and ModelScope model artifacts at install time. Prefer reviewing or pinning versions and hashes first, running it as an unprivileged user, and using voice cloning only with consent from the speaker whose audio is provided.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a local offline TTS capability, but the documented behavior includes downloading remote model artifacts and managing local workspace/model paths that are not clearly disclosed in the core description. This mismatch can mislead operators about network access, supply-chain exposure, and actual functionality, causing them to approve or run the skill under false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 86% confidence
- Finding
The skill is presented as a local offline TTS capability, but the documented behavior includes downloading remote model artifacts and managing local workspace/model paths that are not clearly disclosed in the core description. This mismatch can mislead operators about network access, supply-chain exposure, and actual functionality, causing them to approve or run the skill under false assumptions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs users to run shell commands and installation scripts, but it declares no tool scope or allowed-tools metadata. That creates an authorization and review gap: an agent or user may execute shell-capable behavior that is not explicitly disclosed or constrained, increasing the chance of unintended command execution or unsafe environment changes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill prominently enables zero-shot voice cloning without any warning about consent, impersonation risk, or safe handling of reference audio. In context, this is more dangerous because the skill is explicitly designed to clone voices from short samples, which can facilitate social engineering, fraud, or unauthorized biometric-style voice replication.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The command fetches a remote installer and then runs it locally, giving the downloaded content full execution on the host. Even if the source is reputable, compromise of the distribution channel, DNS/TLS interception, or upstream tampering could lead to arbitrary code execution during installation.
- Content
sh source "$HOME/miniconda3/etc/profile.d/conda.sh" else echo "❌ Conda not found. Installing Miniconda..." curl -LO https://repo.anaconda.com/miniconda/Miniconda3-latest-MacOSX-arm64.sh bash Miniconda3-latest-MacOSX-arm64.sh -b -p $HOME/miniconda3 export PATH="$HOME/miniconda3/bin:$PATH" source "$HOME/miniconda3/etc/profile.d/conda.sh"
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The installer bootstraps a full local runtime by downloading and installing Miniconda, then later clones a remote repository and installs many packages. While this is common for ML setup scripts, it materially expands the trust boundary beyond a simple local TTS skill and introduces supply-chain risk if any upstream artifact is compromised or unexpectedly changed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script downloads a shell installer from the internet and immediately executes it, which is a classic remote code execution and supply-chain exposure pattern. In addition, it clones external code recursively, allowing arbitrary upstream code and submodules to influence the local environment without integrity verification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The synthesis function defaults
lang='zh', making Chinese the implicit language unless the user explicitly overrides it. This is a natural-language policy concern because the skill imposes a specific locale by default rather than asking the user or remaining neutral.- Content
Static analysis
No suspicious patterns detected.