T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tts.py:59- Finding
Predictable Temporary File Enables Symlink-Based File Truncation
- Content
View full analysis
- Remediation
View remediation
Security audit
MOSS-TTS Voice
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do the claimed TTS and voice-cloning work, but it handles sensitive voice uploads and API keys in ways users should review carefully before installing.
Install only if you trust MOSS Studio with the text and voice samples you provide. Use only voices you own or have explicit permission to clone, avoid sensitive recordings, do not print or share MOSS_API_KEY, prefer a secret manager over shell-profile storage, and consider reviewing the temporary-file handling and dependency pinning before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Unbounded Third-Party Dependency Version Weakens Supply-Chain Integrity
- Content
View full analysis
=2.28.0 ``` ### Technical Analysis The dependency declaration specifies only a minimum version. Every installation may consequently resolve to a different current or future release of `requests` and its transitive dependencies. No lock file or package hashes are provided to verify the exact artifacts being installed. There is no evidence that the currently named `requests` package is malicious. The issue is that the build is not reproducible and automatically trusts future compatible releases and the configured package index. A compromised package release, compromised package repository, malicious index configuration, or unexpectedly incompatible update could therefore affect the Skill without a corresponding source-code change. ### Attack Path A supply-chain exploitation path would be: 1. The Skill is installed using: ```bash pip3 install -r requirements.txt ``` 2. The package installer queries its configured package index. 3. Because no exact version or hashes are required, it selects any available `requests` version at or above `2.28.0`, together with dynamically resolved transitive dependencies. 4. If the selected artifact or package index has been compromised, malicious package code is installed into the environment. 5. That code may execute during package installation or later when `requests` is imported by the Skill scripts. This path depends on a compromised or malicious dependency source; the audit found no embedded malicious package in the repository itself. ### Impact Assessment Malicious dependency code would normally execute with the privileges of the user installing or running the Skill. It could access data available to that account, including the `MOSS_API_KEY`, user-supplied text and recordings, generated audio, and writable local files. I ...[truncated 157 chars]- Remediation
View remediation
``` For stronger integrity controls: 1. Generate a lock file containing all transitive dependencies. 2. Include cryptographic hashes, for example with: ```bash pip-compile --generate-hashes requirements.in ``` 3. Install with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 4. Use only a trusted, explicitly configured package index. 5. Review and update pinned dependencies on a controlled schedule. 6. Run dependency vulnerability and provenance checks in CI. 7. Install dependencies in an isolated virtual environment with no unnecessary privileges. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
references/troubleshooting.md:5- Finding
Troubleshooting Guidance Exposes and Persists API Credentials Insecurely
- Content
View full analysis
> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The first diagnostic command prints the complete API key to terminal output. This can disclose the credential through screen sharing, screenshots, terminal recording, copied support logs, scrollback buffers, or automated command-output collection. The persistence example directs users to store the API key as plaintext in `~/.zshrc`. Shell configuration files may be exposed through backups, diagnostics, accidental repository inclusion, overly permissive file permissions, or other processes and users capable of reading the account's files. If a user substitutes a real key directly into an interactive command, that command may also be retained in shell history. Authentication to the MOSS API is necessary for the Skill's functionality, but displaying the complete secret and recommending plaintext shell-profile persistence are not necessary. ### Attack Path A terminal-output disclosure path is: 1. A user follows the troubleshooting instructions and runs: ```bash echo $MOSS_API_KEY ``` 2. The full credential appears in terminal output. 3. The output is captured by a screen-sharing participant, screenshot, terminal logger, support bundle, or scrollback reader. 4. The observer copies the key. 5. The observer sends authenticated requests to the MOSS API as the victim until the key is revoked or expires. A local-file disclosure path is: 1. The user stores a real key in `~/.zshrc` using the documented pattern. 2. Another user, process, backup, synchronization tool, or diagnostic collector obtains read access to that file. 3. T ...[truncated 656 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)
Tainted flow: 'headers' from os.getenv (line 10, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # 1. Upload with open(args.file, "rb") as f: up_resp = requests.post("https://studio.mosi.cn/api/v1/files", headers=headers, files={"file": f}) file_id = up_resp.json().get("file_id")
Tainted flow: 'headers' from os.getenv (line 10, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python # 2. Clone payload = {"file_id": file_id, "voice_name": args.name} cl_resp = requests.post("https://studio.mosi.cn/api/v1/voice/clone", headers=headers, json=payload) print(cl_resp.text)
Tainted flow: 'headers' from os.getenv (line 6, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python url = "https://studio.mosi.cn/api/v1/voices?limit=10&status=ACTIVE" headers = {"Authorization": f"Bearer {api_key}"} resp = requests.get(url, headers=headers) voices = resp.json().get("voices", []) print("| Voice Name | Voice ID | Description |")
Tainted flow: 'headers' from os.getenv (line 77, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python payload["reference_audio"] = base64.b64encode(f.read()).decode("utf-8") try: resp = requests.post(url, json=payload, headers=headers, timeout=60) data = resp.json() except Exception as e: result = {"error": f"API 请求失败: {e}"}
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The documented purpose says the skill performs text-to-speech, voice cloning, and audio generation, but the detected behavior suggests it may only enumerate remote voice metadata and not actually perform the claimed actions. This mismatch is dangerous because agents and users may grant sensitive inputs, API keys, or voice samples under false assumptions, enabling unnecessary data exposure and undermining security review.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # 1. 上传音频 curl -X POST https://studio.mosi.cn/api/v1/files/upload \ -H "Authorization: Bearer $MOSS_API_KEY" \ -F "file=@voice.ogg" # → {"file_id": "YOUR_FILE_ID"}
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill declares capabilities that imply access to environment secrets, filesystem writes, network access, and shell execution, but it does not define an explicit tool scope such as permissions or allowed-tools. That creates an over-privileged integration surface where an agent may invoke the skill with broader powers than necessary, increasing the blast radius if the skill is misused or later modified.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger conditions are broad enough to activate on generic requests like generating speech or using 'my voice,' which can cause unintended invocation in contexts involving sensitive, impersonation-related, or consent-sensitive requests. In a voice-cloning skill, overbroad triggers are more dangerous because accidental activation may prompt collection or upload of reference audio without sufficiently deliberate user confirmation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs users to upload audio files to an external service for cloning, which is a real external data transmission of potentially biometric voice data and associated authentication tokens. Although aligned with the skill's purpose, this is security-sensitive because voice samples are personal data and can be misused for impersonation, privacy violations, or retention beyond the user's expectations.
- Content
bash # 1. 上传并克隆 curl -X POST https://studio.mosi.cn/api/v1/files/upload \ -H "Authorization: Bearer $MOSS_API_KEY" \ -F "file=@voice.ogg" # → {"file_id": "YOUR_FILE_ID"}
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
使用预注册音色：
bash curl -X POST https://studio.mosi.cn/v1/audio/tts \ -H "Authorization: Bearer $MOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This duplicate finding covers the same real issue: the sample posts reference audio to a remote endpoint for real-time cloning/TTS. Because the skill's purpose includes voice cloning, this transmission is more sensitive than ordinary API traffic and can expose biometric data to third-party processing without adequate safeguards in the guide.
- Content
md with open("voice.ogg", "rb") as f: audio_base64 = base64.b64encode(f.read()).decode() resp = requests.post( "https://studio.mosi.cn/v1/audio/tts", headers={"Authorization": f"Bearer {API_KEY}"}, json={
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This duplicate finding covers the same real issue: the sample posts reference audio to a remote endpoint for real-time cloning/TTS. Because the skill's purpose includes voice cloning, this transmission is more sensitive than ordinary API traffic and can expose biometric data to third-party processing without adequate safeguards in the guide.
- Content
md with open("voice.ogg", "rb") as f: audio_base64 = base64.b64encode(f.read()).decode() resp = requests.post( "https://studio.mosi.cn/v1/audio/tts", headers={"Authorization": f"Bearer {API_KEY}"}, json={
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide documents uploading voice samples and cloning a voice without any warning about consent, biometric sensitivity, or lawful use. In the context of a voice-cloning skill, this omission is dangerous because users may be encouraged to transmit and reproduce another person's voice without authorization, enabling impersonation, fraud, or privacy violations.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
This example invokes the voice-cloning endpoint using a previously uploaded audio file, enabling creation of a reusable synthetic voice from user-provided speech. In this skill context, that is inherently sensitive because it facilitates scalable impersonation if consent, authorization, and abuse-prevention requirements are not clearly documented.
- Content
示例
bash curl -X POST https://studio.mosi.cn/api/v1/voice/clone \ -H "Authorization: Bearer $MOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"file_id": "YOUR_FILE_ID", "name": "我的声音"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md MOSS_API_KEY="sk-xxx" python3 -c " import requests, json headers = {'Authorization': f'Bearer \$MOSS_API_KEY', 'Content-Type': 'application/json'} resp = requests.post('https://studio.mosi.cn/v1/audio/tts', headers=headers, json={'model': 'moss-tts', 'text': 'test'}, timeout=10)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md MOSS_API_KEY="sk-xxx" python3 -c " import requests, json headers = {'Authorization': f'Bearer \$MOSS_API_KEY', 'Content-Type': 'application/json'} resp = requests.post('https://studio.mosi.cn/v1/audio/tts', headers=headers, json={'model': 'moss-tts', 'text': 'test'}, timeout=10)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file uses Chinese throughout, including headings, instructions, and examples, and does not indicate that the skill is region-specific or that users may choose another language. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The troubleshooting step explicitly instructs users to print the API key with
echo $MOSS_API_KEY, which can expose the credential on-screen, in terminal scrollback, screen recordings, shared sessions, or support screenshots. In a skill that handles paid API access and voice-cloning operations, leaking the bearer token could allow unauthorized use of the service and abuse of the account.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document tells users to append a plaintext API key export directly into
~/.zshrc, creating long-term credential storage in a shell startup file that may be backed up, synced, or read by other local tooling. This increases the persistence and exposure window of a sensitive bearer token without discussing safer secret-management options.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md headers = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"} # 测试 TTS resp = requests.post( "https://studio.mosi.cn/v1/audio/tts", headers=headers, json={"model": "moss-tts", "text": "测试", "voice_id": "YOUR_VOICE_ID"},
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md headers = {"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"} # 测试 TTS resp = requests.post( "https://studio.mosi.cn/v1/audio/tts", headers=headers, json={"model": "moss-tts", "text": "测试", "voice_id": "YOUR_VOICE_ID"},
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script uploads an arbitrary user-supplied local file to a third-party remote API with no in-code consent prompt, disclosure, or validation of what is being sent. In a voice-cloning skill, this is especially sensitive because audio samples may contain biometric voice data, creating privacy, compliance, and inadvertent data-sharing risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This code performs external transmission of a local file to a third-party service. In the context of a voice-cloning tool, the transmitted content is likely sensitive biometric audio, so outbound transfer is materially security-relevant and should not occur silently.
- Content
python # 1. Upload with open(args.file, "rb") as f: up_resp = requests.post("https://studio.mosi.cn/api/v1/files", headers=headers, files={"file": f}) file_id = up_resp.json().get("file_id")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # 2. Clone payload = {"file_id": file_id, "voice_name": args.name} cl_resp = requests.post("https://studio.mosi.cn/api/v1/voice/clone", headers=headers, json=payload) print(cl_resp.text)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python # 2. Clone payload = {"file_id": file_id, "voice_name": args.name} cl_resp = requests.post("https://studio.mosi.cn/api/v1/voice/clone", headers=headers, json=payload) print(cl_resp.text)
Static analysis
No suspicious patterns detected.