ClawHub
Back to skill

Security audit

MOSS Voice Generator 指令式音色生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MOSI voice-generation tool, but users should avoid sending sensitive text and should keep the API key out of command-line arguments.

Install only if you are comfortable sending the text to be spoken and the voice-style description to MOSI Studio for processing. Prefer setting MOSI_TTS_API_KEY through the environment or a secret manager rather than using --api-key, avoid sensitive text, and confirm before sending generated audio into Feishu chats.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mosi_voice_generator.sh:39
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes shell scripts and documents executable bash commands, but it does not declare any explicit tool scope such as allowed shell access. That creates a policy and review gap: an agent may run shell-capable behavior without clear least-privilege boundaries, increasing the chance of unintended command execution or abuse if the skill is auto-invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases include broad natural-language terms like "generate voice", "描述一个声音", and style-oriented wording that can appear in ordinary conversation. This raises the risk of unintended skill activation, which in this context could cause external API calls, audio generation, and downstream actions like sending voice messages without the user explicitly intending to invoke the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This code performs an outbound HTTPS POST to a third-party API containing user-supplied text and style instructions along with an authorization token. In an agent skill context, silent external transmission is security-relevant because users may assume local-only processing and unknowingly expose sensitive data.

Content

Scanner excerpt · scripts/mosi_voice_generator.sh (reported line 80)May include surrounding context.

sh
echo "Generating voice..." >&2

RESPONSE=$(curl -sf -X POST \
  "https://studio.mosi.cn/api/v1/audio/speech" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends user-provided text and voice-style instructions to an external MOSI API, but the interface and help text do not clearly warn users that their content will leave the local environment. This can cause unintended disclosure of sensitive prompts, names, or confidential material if the skill is used in broader agent workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script writes generated audio to a predictable default path under the user's home directory without prominently warning the user. This can lead to accidental retention of potentially sensitive synthesized content or confusion about where generated files are stored.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.