Security audit
Security checks for vulnerabilities and agentic risk
This text-to-speech skill appears aligned with its purpose, but it needs review because it combines broad local command execution with API-key handling that can expose the key in process arguments.
Review before installing. Use a limited SiliconFlow API key if possible, avoid sending confidential text unless SiliconFlow handling is acceptable for your use case, and prefer a version-pinned installer. The package does not show hidden persistence or destructive behavior, but its broad exec permission and command-line token handling are meaningful risks.
scripts/generate.py:85API Key Exposed Through Child Process Command-Line Arguments
README.md:15Unpinned Package Runner Used in Installation Instructions
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
def get_api_key():
"""Get API key from environment or OpenClaw config"""
api_key = os.environ.get("SILICONFLOW_API_KEY")
if api_key:
return api_key
The README promotes cloud TTS usage via the SiliconFlow API and asks users to provide an API key, but it does not disclose that submitted text will be transmitted to an external third-party service. This omission can cause users to unknowingly send sensitive, regulated, or proprietary content off-device, creating privacy, compliance, and data-handling risks in contexts where prompts may contain confidential information.
The README instructs users to run npx clawhub install siliconflow-tts-gen without pinning a specific package version, which can lead to non-reproducible installs and exposure to a compromised or malicious newly-published version. Because this is an installation command executed directly by users, a supply-chain compromise of the referenced package or its latest tag could result in arbitrary code execution on the user's machine.
The skill declares access to environment variables and local files and demonstrates shell-based execution, but it does not define any explicit tool scope such as permissions or allowed-tools. That increases the attack surface because an agent runtime may grant broader capabilities than users expect, including access to the API key and local configuration file mentioned in the manifest.
The installation instruction uses npx clawhub without pinning a specific version, which creates a supply-chain risk because future or compromised package versions could execute different code at install time. In an agent skill context, that is more dangerous because installation may occur automatically or with elevated trust, potentially leading to arbitrary code execution before the user reviews the skill.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import subprocess
# API Configuration
API_BASE_URL = "https://api.siliconflow.cn/v1"
DEFAULT_MODEL = "FunAudioLLM/CosyVoice2-0.5B"
DEFAULT_VOICE = "alex"
The skill sends arbitrary user-provided text to a third-party TTS service, but the script does not present an explicit disclosure or consent boundary before transmission. In an agent-skill context, users may provide sensitive prompts or data without realizing it will leave the local environment.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"-o", output_path
]
result = subprocess.run(curl_cmd, capture_output=True)
if result.returncode != 0:
print(json.dumps({
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
"-o", output_path
]
result = subprocess.run(curl_cmd, capture_output=True)
if result.returncode != 0:
print(json.dumps({
The trigger pattern "tts" is very broad and likely to match casual shorthand in unrelated conversations, causing the skill to activate unexpectedly. In a skill that also has elevated capability such as "exec", accidental invocation becomes more dangerous because it increases opportunities for unintended command execution or data handling.
The manifest requests the generic "exec" tool even though the stated purpose is only text-to-speech via an external API. A generic command-execution capability greatly expands the attack surface because any prompt-triggered or compromised skill logic could invoke arbitrary local commands, access files, or exfiltrate secrets such as API keys and user data.
No suspicious patterns detected.