ClawHub
Back to skill

Security audit

LrshuAI Text To Speech

Security checks for vulnerabilities and agentic risk

Overview

This text-to-speech skill mostly does what it claims, but it also gives itself broader model/file-upload abilities and bypasses the normal runner without enough disclosure.

Install only if you trust the publisher, the dlazy.com or configured TEAM_BASE_URL endpoint, and the scope of TEAM_API_KEY. Treat this as more than a simple TTS helper: avoid passing local media files unless you intend to upload them, and prefer a version that restricts models to TTS, declares network/dependency requirements, and uses the standard OpenClaw runner.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()
Confidence
94% confidence
Finding
The request target is taken from the TEAM_BASE_URL environment variable and used directly for an authenticated POST request. If that variable is altered, the script will send the bearer token, prompt text, and any base64-encoded local image/video data to an attacker-controlled endpoint, creating a clear exfiltration path.

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()
Confidence
92% confidence
Finding
The polling URL is derived from the same untrusted base URL and used in authenticated GET requests, so a malicious endpoint can continue receiving the bearer token and job metadata throughout the polling loop. This extends the exposure window and can leak generation identifiers and follow-up results to an attacker-controlled server.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no explicit permissions while requiring an environment API key and directing execution of a Python script that likely performs outbound network requests. This creates a transparency and governance gap: users and the platform cannot accurately assess what privileges the skill needs before it runs, increasing the chance of unintended credential use or external data transmission.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
A skill presented as simple text-to-speech but backed by a generic model invoker that can handle arbitrary model IDs and multimodal inputs materially expands the attack surface beyond the stated purpose. This mismatch can mislead users and calling agents into sending sensitive local files, remote URLs, or unexpected prompts to remote services under the assumption that the skill only performs TTS.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The implementation is a generic multimodal model invoker despite the skill being presented as text-to-speech only. This mismatch expands the capability surface beyond user expectations, increasing the risk that prompts and media are handled or transmitted in ways the user did not knowingly authorize.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
Image and video ingestion is unrelated to a text-to-speech skill and allows local multimedia files to be read, base64-encoded, and uploaded to a remote service. In this context, the unjustified extra capability materially increases the chance of covert or unexpected data exfiltration from the host environment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to bypass the normal skill runner and directly execute a Python script while using an API key, without warning the user about code execution or credential usage. Forcing direct execution reduces platform mediation and auditing opportunities, and can expose secrets or enable behavior outside the expected sandboxed invocation path.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script sends prompts and optional local file contents to a remote API without an explicit consent or disclosure mechanism at execution time. For a skill advertised as text-to-speech, this is more dangerous because users would not reasonably expect local images or videos to be uploaded to an external server.

Static analysis

No suspicious patterns detected.