Audio Gen 1.0.0

• Analyzed: Mar 21, 2026, 12:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: 4c59687252c752a85a987cb45afb13e8177ad2885c8c5111cb5d6e7d0b11d21a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill generates audio by invoking a local Python script (/home/clawdbot/clawdbot/skills/sag/scripts/tts.py) via a shell command. It is classified as suspicious due to a potential command injection vulnerability in the shell command construction, where the agent is instructed to pass a generated script directly into a double-quoted string or a heredoc without explicit instructions for shell-escaping. While the functionality aligns with the stated purpose of audio generation and requires legitimate API keys (ELEVENLABS_API_KEY), the reliance on hardcoded absolute paths and the risk of executing unsanitized content via 'uv run' pose a security risk.