gtts

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 0.1.0

Overview

This is a straightforward text-to-speech skill that discloses its network use and has only a routine dependency-installation caution.

Install in a virtual environment, consider pinning reviewed package versions, and remember that text processed by gTTS is sent over the network to Google's service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install gtts pydub

Technical Analysis

The installation command retrieves the latest available versions of gtts and pydub from the package index configured in the user's environment. It does not specify reviewed versions, validate package hashes, or explicitly require a trusted index.

Consequently, the dependencies and their installation behavior may change after the Skill has been reviewed. If an upstream release or configured package source is compromised, package-controlled build or installation logic could execute on the user's system. The absence of pinned versions also prevents deterministic installation and makes dependency auditing less reliable.

Attack Path

1. An attacker compromises an upstream package release, package-maintainer account, or package index used by the target environment.
2. The attacker publishes a malicious version of gtts, pydub, or one of their transitive dependencies.
3. A user follows the documented pip install gtts pydub instruction.
4. pip retrieves the attacker-controlled release because no reviewed version or integrity hash is required.
5. Malicious build, installation, or runtime code executes with the privileges of the user performing the installation.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. The affected scope can include the Python environment, files and credentials accessible to that user, generated audio content, and network-accessible resources available from the host. If installation is performed as an administrator or root user, the impact could extend to system-wide compromise. Exploitation depends on compromise or manipulation of a package release or effective package source; no ev ...[truncated 77 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct and transitive dependency to a reviewed version through a lock file or fully constrained requirements file.
• Record cryptographic hashes and install with pip install --require-hashes.
• Explicitly configure a trusted package index rather than relying on an uncontrolled environment-level index configuration.
• Review dependency provenance, release history, maintainers, and known vulnerabilities before approving versions.
• Install dependencies inside a dedicated virtual environment or other isolated environment.
• Avoid running package installation as root or an administrator.
• Use automated dependency scanning and controlled update procedures to evaluate new releases before deployment.

A hardened installation workflow should use reviewed constraints and hashes, for example:

bash

python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.