T08 · Insecure Dependencies
Warning
- Location
models/vits-piper-zh_CN-huayan-medium/vits-piper.sh:17- Finding
Unverified Third-Party Packages and Remotely Hosted Assets
- Content
View full analysis
- Remediation
View remediation
Security audit
voice-huayan
Security checks for vulnerabilities and agentic risk
Overview
The skill claims to be local Chinese voice playback, but the package contains under-disclosed setup scripts that install packages and download remote model assets.
Review this before installing. Only use it if you are comfortable with a skill that may require manual repair and whose bundled setup script can install Python packages and download model assets from external services without verification. Prefer a version that includes the advertised playback script, pins dependencies, verifies downloaded files, and limits downloads to the declared zh_CN-huayan-medium model.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as local playback, but the reported behavior includes downloading arbitrary models from remote sources, installing dependencies at runtime, and supporting unrelated voices/languages based on environment variables. That is a significant trust-boundary violation: network retrieval and runtime package installation can introduce supply-chain risk and enable execution paths far beyond what a local offline TTS skill implies.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as local playback, but the reported behavior includes downloading arbitrary models from remote sources, installing dependencies at runtime, and supporting unrelated voices/languages based on environment variables. That is a significant trust-boundary violation: network retrieval and runtime package installation can introduce supply-chain risk and enable execution paths far beyond what a local offline TTS skill implies.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable behavior but does not declare any tool scope or permissions, despite requiring shell, environment, and file access capabilities. This creates an authorization and transparency gap: a caller cannot reliably understand or constrain what the skill may do, which increases the chance of unintended command execution or file operations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest description and heading describe the skill as specifically providing Chinese TTS playback and a Chinese voice style, with no indication that users can choose another language or that this locale restriction is optional. Under the policy rule, fixed language behavior without user opt-in can be a natural-language locale policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a local Chinese TTS playback skill with Piper/System.Speech fallback for reading replies aloud, but this file does not perform playback or fallback at all. Instead, it edits ONNX model metadata, reads a model config JSON, and generates a tokens.txt file, which are model packaging/preparation tasks rather than runtime speech output behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Although the skill is presented as a huayan-specific local TTS capability, the script is a generic downloader driven by environment variables that can fetch arbitrary language/voice combinations. That broader-than-advertised behavior increases attack surface, weakens auditability, and makes it easier to repurpose the skill for unintended remote asset retrieval.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script contradicts the skill's 'local playback' description by performing runtime package installation and multiple external downloads from PyPI, Hugging Face, and GitHub. This expands the trust boundary to remote infrastructure and enables supply-chain compromise, unexpected code execution during install, or environment modification on the user's machine.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Running 'pip install iso639-lang' at execution time introduces arbitrary third-party code into the environment for a task that should be local playback. Package installation can trigger installer code and dependency resolution from remote sources, creating unnecessary supply-chain and system integrity risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script modifies the host environment by installing packages, downloading files, extracting archives, and deleting files with no user-facing warning or confirmation. For a TTS skill, those side effects are disproportionate and reduce user ability to make an informed trust decision before the system is changed.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script downloads model files and an archive from external services at runtime, then extracts and uses them without integrity verification. In a skill marketed as local-only playback, this is especially dangerous because users may not expect network access or remote content execution paths, and a compromised upstream or MITM-adjacent scenario could deliver malicious assets or poisoned dependencies.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
For a skill whose stated purpose is local TTS playback, mutating ONNX files in place and generating tokens.txt are not obvious runtime requirements of reading replies aloud. These are build-time or maintenance capabilities that expand beyond the user-facing playback function described in the manifest.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This manifest-style JSON specifies a fixed language and region of zh_CN/China in natural-language metadata, with no indication that users can choose another locale or opt in to the restriction. The policy asks to flag language or locale constraints unless they are clearly documented and justified as region-specific, which is not evident in this file alone.
- Content