openai-tts-python

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:27 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent OpenAI text-to-speech helper, but users should be careful because broad activation wording could send text to a remote API and create audio files unexpectedly.

Install this only if you are comfortable sending the text you convert to OpenAI's API and paying any associated API costs. Avoid using it on secrets, credentials, regulated data, or confidential documents unless that remote processing is approved, and prefer pinned dependency versions in an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:7-8
• manifest.json:20-23
• skill.md:36-40
• openai_tts.py:90-94
• openai_tts.py:128-133

Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

README.md:7-8:

bash

pip install openai pydub

manifest.json:20-23:

json

"requirements": {
  "env_vars": ["OPENAI_API_KEY"],
  "python_packages": ["openai", "pydub"],
  "system_packages": ["ffmpeg"]
},

skill.md:36-40:

markdown

## Requirements

- `OPENAI_API_KEY` environment variable must be set
- Python 3.8+
- Dependencies: `openai`, `pydub` (optional, for long text)

openai_tts.py:90-94:

python

try:
    from openai import OpenAI
except ImportError:
    print("Error: openai package not installed. Run: pip install openai")
    return False

openai_tts.py:128-133:

python

try:
    from pydub import AudioSegment
except ImportError:
    print("Error: pydub required for long text. Run: pip install pydub")
    print("Also ensure ffmpeg is installed.")
    return False

Technical Analysis

The project declares and recommends installing openai and pydub without version constraints or cryptographic hashes. Consequently, each installation may resolve to a different and mutable package release.

Python package installation can execute package-controlled build or installation logic. If a future dependency release, its maintainer account, or the package distribution channel is compromised, users following the documented command could install attacker-controlled code. Unpinned dependencies also allow incompatible releases to be selected without prior project review.

The dependency names are consistent with the implementation, and the project does not direct users to an unknown package index or suspicious download domain. Therefore, this finding represents an avoidable s ...[truncated 1410 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency file with exact versions, for example:

   text

   openai==<reviewed-version>
   pydub==<reviewed-version>
   

2. Generate and verify cryptographic hashes for all Python distributions, and install with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a lock-file workflow that records transitive dependencies, not only the two direct dependencies.

4. Configure installation to use the official Python Package Index over TLS and avoid untrusted additional package indexes.

5. Pin and document a tested FFmpeg version or supported version range. Obtain it only through a trusted operating-system package repository.

6. Run dependency vulnerability and provenance checks in continuous integration. Review dependency updates before modifying the lock file.

7. Install and run the Skill in an isolated virtual environment under a non-administrative account with access only to required files and credentials.

8. Replace the runtime messages recommending unrestricted installation with instructions that reference the locked dependency file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The explicit trigger list contains ambiguous single-word and generic phrases such as 'voice', 'podcast', 'speak', and 'tts' without scope constraints. This substantially increases the chance of false activation, which is especially risky because the skill sends user text to an external API and may generate billable output or expose sensitive content that was never meant for speech synthesis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes text-to-speech functionality but does not warn users that submitted text is transmitted to OpenAI's remote API for processing. This can cause accidental disclosure of sensitive, proprietary, or regulated text if users assume processing is local, and the skill context increases the risk because users may paste arbitrary documents or private content for narration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt install ffmpeg

text

## Setup

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest advertises broad activation on common phrases like 'voice' and 'podcast' in its summary/activation guidance, which can cause the skill to be selected when the user did not clearly request TTS. In an agent ecosystem, overbroad invocation can lead to unintended outbound API calls, unnecessary cost, and accidental transmission of user content to the OpenAI TTS service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user-provided text directly to OpenAI's TTS API, which transmits that content to an external service, but it does not clearly warn the user that their input leaves the local environment. In a CLI skill that may be used on arbitrary text or file contents, this can lead to unintentional disclosure of sensitive data such as private documents, credentials, or regulated content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match common conversational terms like 'voice', 'audio', 'speak', or 'podcast', which can cause the skill to activate when a user did not explicitly request text-to-speech. In this skill, unintended activation can result in user text being sent to an external API and audio files being generated, creating privacy, cost, and workflow risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explains functionality but does not clearly disclose that supplied text is sent to OpenAI's external API and that generated audio is saved locally. Users or calling agents may therefore pass sensitive content without understanding the data transfer and persistence implications, leading to privacy or compliance issues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation section lists many positive triggers but provides no scope boundaries or exclusions, so the agent may invoke the skill for loosely related requests involving audio or narration. Because this skill transmits content externally and writes output files, ambiguity in activation increases the chance of accidental data exposure or unintended file creation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.