LH Edge TTS

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:38 PM UTC
• Version: 1.0.0

Overview

This is a coherent text-to-speech skill with expected online-service and local-file behavior, but users should be careful with sensitive text and the unpinned Python dependency.

Install this only if you are comfortable sending TTS input to Microsoft Edge's online TTS service. Avoid converting secrets, private documents, regulated data, or credentials. Prefer installing in a virtual environment and pinning/reviewing `edge-tts` before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: install.sh:9

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: install.sh:9; corroborated by SKILL.md:109, DISTRIBUTION.md:24, and skill-info.json:10-13
Vulnerability Type: Unpinned and integrity-unverified dependency installation
Risk Level: Medium

Vulnerable Code

install.sh:9:

bash

pip install edge-tts

skill-info.json:10-13:

json

"dependencies": {
  "edge-tts": ">=7.0.0"
},
"install": {
  "command": "pip install edge-tts"
}

The same unpinned installation command is also documented in SKILL.md:109 and DISTRIBUTION.md:24.

Technical Analysis

The installation process retrieves edge-tts and its transitive dependencies from the pip index configured in the user's environment without enforcing an exact reviewed version or validating package integrity with cryptographic hashes. The >=7.0.0 metadata constraint permits any present or future compatible release, while the actual installation command applies no version constraint at all.

Python packages may execute code during installation, and their modules execute code when imported. Consequently, compromise of the upstream package, one of its transitive dependencies, or the configured package index could cause attacker-controlled code to run with the installing user's privileges. Dependency resolution could also silently select a future release that has not been audited with this Skill.

The repository does not itself contain evidence that edge-tts is malicious. The confirmed issue is the absence of deterministic version and integrity controls around executable third-party code.

Attack Path

1. An attacker compromises the edge-tts distribution, a transitive dependency, or a package index used by the victim.
2. The attacker publishes or serves a malicious release that satisfies pip's unconstrained dependency resolution.
3. A user runs install.sh or follows the documented `pip install edge-tt ...[truncated 1064 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin edge-tts to an exact, reviewed version rather than using an unconstrained installation:

   text

   edge-tts==REVIEWED_VERSION
   

2. Generate a lock file containing fully pinned transitive dependencies and SHA-256 hashes using a dependency-locking tool such as pip-tools.

3. Enforce integrity verification during installation:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Update install.sh, SKILL.md, DISTRIBUTION.md, and skill-info.json so they consistently reference the locked dependency set.

5. Install dependencies inside a dedicated virtual environment rather than the global or system Python environment.

6. Review and test dependency updates before changing pinned versions. Use automated vulnerability and provenance scanning as part of the release process.

7. Where supported, use a trusted internal package mirror and retain reviewed package artifacts to prevent unexpected upstream replacement.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The stated purpose is TTS generation, but the skill also includes persistent configuration management via ~/.tts-config.json and generic CLI operations unrelated to immediate speech synthesis. This mismatch can mislead reviewers and users about what state is stored and what side effects occur, increasing the risk of unintended persistence or misuse in environments expecting a stateless media tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide explicitly requires an internet connection for the TTS service but does not disclose that user-supplied text may be transmitted to a third-party remote service for synthesis. In a TTS skill, users may submit sensitive prompts, documents, or personal data, so the missing privacy warning can lead to unintended data exposure and compliance issues.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation describes use of local Python scripts that read input files and write audio, subtitle, and configuration files, yet it declares no tool scope or permissions boundaries. In an agent environment, missing explicit restrictions can allow broader-than-intended filesystem access and make it harder to enforce least privilege around file reads/writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance says to trigger on TTS intent from 'triggers or user request' without tight constraints, which can cause the skill to run when the user merely mentions TTS conceptually or quotes the keyword. In agent systems, overbroad activation can lead to unintended content transformation, unexpected file creation, and accidental transmission of sensitive text to an external online TTS service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger detection relies on the generic keyword 'tts' and even suggests automatic filtering of TTS-related keywords from text before conversion, which increases ambiguity and the chance of accidental activation. Because this skill uses an online service, erroneous triggering could expose user text externally and generate unwanted media artifacts without a sufficiently explicit command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The top-level natural-language documentation is written entirely in Chinese, while the CLI parser description/help strings are in English elsewhere, and the default configuration hard-codes English locale values. This creates a language/locale assumption without any stated user choice or justification for why the skill should default to or require those locales.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring and usage instructions are written in Chinese, and several inline comments/docstrings throughout the file also assume Chinese as the presentation language. This creates a language-policy concern because the skill imposes a specific language on users without any opt-in or documented region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.