LrshuAI Text To Speech

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:54 AM UTC
• Version: 1.0.0

Overview

This skill is presented as text-to-speech, but its bundled script can act as a broader remote model proxy and upload local image or video files to an external endpoint.

Review before installing. Use this only if you trust the publisher and the configured endpoint, and do not provide sensitive local image or video paths. Prefer a version that uses the managed runner, pins or allowlists the API host, clearly discloses all data sent externally, and removes non-TTS media/model-broker features.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: script/invoke_model.py:14

Finding

Undeclared Local File Upload to an External Service

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:5

Finding

Managed Execution Path Bypassed by Mandatory Direct Python Invocation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: script/invoke_model.py:35

Finding

Bearer Credential Can Be Forwarded to an Unrestricted Environment-Controlled Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: script/invoke_model.py:101

Finding

Unbounded HTTP Requests and Infinite Status Polling

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The request destination is taken from the TEAM_BASE_URL environment variable and used directly for authenticated outbound requests. If that variable is attacker-controlled or misconfigured, prompts, embedded local media, and the bearer token can be sent to an unintended external service, turning this skill into a credential and data exfiltration channel.

Content

Scanner excerpt · script/invoke_model.py (reported line 115)May include surrounding context.

python

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The polling request reuses the same environment-derived endpoint and authorization header, so an attacker-controlled base URL continues receiving authenticated traffic after job submission. This extends the exfiltration window and can leak task identifiers, model outputs, and metadata to an untrusted remote server.

Content

Scanner excerpt · script/invoke_model.py (reported line 136)May include surrounding context.

python

while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A text-to-speech skill that also invokes generic remote AI functionality and appears to support unrelated image/video flows creates a scope mismatch between user expectations and actual capability. Hidden broader functionality increases the chance of unintended data transfer, misuse of credentials, and execution of operations outside the user-approved purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The declared skill purpose is text-to-speech, but the implementation is a generic multimodal model broker accepting arbitrary model names plus image and video inputs. This capability mismatch is dangerous because it can bypass policy expectations and user trust, enabling broader remote data handling and model access than the skill metadata suggests.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · script/invoke_model.py (reported line 11)May include surrounding context.

python

import os
import sys
import argparse
import base64
import requests
import json
import mimetypes
import time

def parse_args():
    parser = argparse.ArgumentParser(description='Invoke Team AI Models via unified API')
    parser.add_argument('--model', type=str, required=True, help='The model ID to use (e.g., qwen3_5-plus, sora-2, etc.)')
    parser.add_argument('--prompt', type=str, required=True, help='The prompt text to send to the model')
    parser.add_argument('--image', type=str, help='Path to the local image file or remote image URL (First frame)')
    parser.add_argument('--image-tail', type=str, help='Path to the local image file or remote image URL (Tail/Last frame)')
    parser.add_argument('--video', type=str, help='Path to the local video fi

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Image, tail-frame, and video support are unrelated to a normal text-to-speech workflow and permit uploading arbitrary local media or remote URLs to an external model endpoint. In the context of a TTS skill, these hidden extra capabilities materially increase the risk of unauthorized data transfer and misuse as a general-purpose generation proxy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises code-capable behavior through required Python execution and use of an environment credential, but it does not declare any explicit tool scope or allowed-tools constraints. This weakens sandboxing and reviewability, making it easier for the skill to access network and secrets in ways the user and hosting agent may not clearly authorize.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill description and operational instructions are written to assume Chinese-language interaction and examples, without indicating that users may choose another language or that the locale restriction is intentional and justified. This can constitute a language/locale policy issue when the skill effectively constrains use to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to bypass the standard skill runner and directly execute a local Python script, while also requiring an API key in the environment. Direct execution reduces platform mediation and auditing, and can expose secrets or enable arbitrary networked behavior under the guise of a simple TTS request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Using environment-sourced credentials and a configurable external endpoint makes this code a generic remote model broker rather than a dedicated TTS tool. In context, that broadens the trust boundary and increases the chance that operators unknowingly expose prompts, media, and tokens to third-party infrastructure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · script/invoke_model.py (reported line 115)May include surrounding context.

python

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill transmits user prompts and optionally local files to a remote API without an in-band warning or consent step. For a skill presented as simple text-to-speech, this is risky because users may not realize their content and media are leaving the local environment.

Content

No source excerpt is available for this finding.