Doubao Podcast TTS

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This is a coherent Doubao/ByteDance podcast TTS skill; the main caution is that it may trigger too broadly for generic podcast TTS requests.

Install this only if you intend to use Doubao/ByteDance podcast TTS. Keep API keys in environment variables or a secrets manager, review the helper script before running it, and do not send private articles, internal URLs, or confidential text unless third-party processing by ByteDance is acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger instructs use of this skill for any podcast TTS or podcast generation task, even without explicit Doubao mention, which is overly expansive. Over-broad routing can misapply ByteDance-specific protocol, authentication, storage, and architecture guidance to unrelated systems, leading to unsafe actions, incorrect credential handling, or inappropriate file/network operations in contexts the skill was not designed for.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sends user-supplied article URLs or text, along with API credentials, to ByteDance over a network connection without any explicit user notice, consent prompt, or redaction guidance. In a skill context, this can cause unintended disclosure of sensitive content or internal URLs to a third-party service, especially if the caller assumes local-only processing.

VirusTotal

66/66 vendors flagged this skill as clean.