Security audit
Security checks for vulnerabilities and agentic risk
This looks like a real text-to-speech skill, but it sends user text to an external API and has enough documentation mismatches that users should review it before installing.
Install only if you are comfortable sending text you ask to read aloud to the SkillBoss/HeyBoss TTS API. Avoid using it for secrets, private messages, regulated data, or confidential work until the publisher clarifies provider/data handling, fixes the subtitle and dependency documentation mismatches, and tightens activation/confirmation behavior.
The skill claims a narrower TTS-only behavior, but the documentation also indicates local file output, extra controls such as volume, and a CLI utility surface including voice listing, while subtitle support appears overstated. This kind of description/behavior mismatch weakens reviewability and can hide resource access patterns such as filesystem writes that are relevant to security and privacy assessment.
The skill claims a narrower TTS-only behavior, but the documentation also indicates local file output, extra controls such as volume, and a CLI utility surface including voice listing, while subtitle support appears overstated. This kind of description/behavior mismatch weakens reviewability and can hide resource access patterns such as filesystem writes that are relevant to security and privacy assessment.
The lockfile pins transitive dependency ws to version 8.19.0, and the supplied advisory data indicates this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial-of-service issue. In a TTS skill, node-edge-tts relies on WebSocket communication to a remote service, so a vulnerable ws library increases risk if the skill processes attacker-influenced responses or is exposed to hostile/intercepted endpoints, potentially causing crashes or unintended data exposure.
The file states that internet access is required and links to an external voice-testing site, but it does not warn that user-provided text and possibly generated audio may be transmitted to third-party services. Because this skill handles arbitrary text for speech generation, missing disclosure can lead users to send sensitive or regulated content to external providers without realizing the privacy implications.
The documentation instructs users to export a required API key and run installation and tests, but it does not warn that the credential is sensitive, should not be committed to shell history, logs, or source control, and should be stored securely. In a skill ecosystem, users may copy-paste these commands into shared environments or CI systems, increasing the chance of accidental secret exposure.
The skill documents use of environment variables and outbound network access to a third-party TTS API, but it does not declare any tool scope such as permissions or allowed-tools. This creates a governance gap: an agent may invoke networked or environment-backed functionality without explicit policy review, increasing the risk of overbroad execution and accidental secret exposure.
The trigger guidance is broad enough that ordinary mentions of "tts" or related phrasing may activate the skill automatically, potentially sending unintended user content to a remote TTS service. In a conversational agent, ambiguous activation increases the risk of privacy-impacting data egress and surprising tool use without clear user intent.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Requires `SKILLBOSS_API_KEY` environment variable
- Output is MP3 format by default
- Requires internet connection
- **Temporary File Handling**: By default, audio files are saved to the system's temporary directory (`/tmp/edge-tts-temp/` on Unix, `C:\Users\<user>\AppData\Local\Temp\edge-tts-temp\` on Windows) with unique filenames (e.g., `tts_1234567890_abc123.mp3`). Files are not automatically deleted - the calling application (Clawdbot) should handle cleanup after use. You can specify a custom output path with the `--output` option if permanent storage is needed.
- **TTS keyword filtering**: The skill automatically filters out TTS-related keywords (tts, TTS, text-to-speech) from text before conversion to avoid converting the trigger words themselves to audio
- For repeated preferences, use `config-manager.js` to set defaults
- **Default voice**: `en-US-MichelleNeural` (female, natural)
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The guide encourages use of an online TTS service and even notes it uses Microsoft Edge's online service, but it does not clearly warn at the integration point that submitted text may be transmitted to a third party. In a TTS skill, users may send sensitive prompts, personal data, or confidential content, so omission of a clear data-sharing warning creates a real privacy and compliance risk.
The script sends user-provided text to an external third-party API service for speech generation, which creates a real data-exposure boundary. In a TTS skill, this is expected behavior, but it is still security-relevant because sensitive prompts, personal data, or secrets could be transmitted off-host without explicit user awareness or policy enforcement.
const os = require('os');
const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';
// Constants
const DEFAULT_TIMEOUT_MS = 10000;
The manifest says the skill supports subtitle generation, and the CLI option '--save-subtitles' suggests subtitles will be produced. In practice, the code only adds 'save_subtitles' to the API request and then exclusively reads 'result.result.audio_base64' and writes an audio file, with no handling or persistence of subtitle data.
The option description says 'Save subtitles as JSON file', which communicates a concrete side effect to users. However, no code writes any subtitle JSON file or processes subtitle content at all; only the audio file is saved.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"test": "node tts-converter.js \"Hello, world! This is a test of the TTS service.\" -f test-output.mp3 && echo \"Test completed successfully!\""
},
"dependencies": {
"commander": "^11.0.0"
},
"author": "Clawdbot",
"license": "MIT"
The code sets lang = 'en-US' as the default language, which imposes a specific locale choice when the user does not provide one. Under the policy, forcing a language or locale without explicit opt-in can be a natural-language policy violation unless clearly justified as region-specific.
Detected: suspicious.env_credential_access