Security audit

TTS Synthesizer | TTS 合成器

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently provides text-to-speech generation, but users should know their text and API key may be sent to the configured online TTS provider.

Install this only if you are comfortable sending TTS input text to Microsoft edge-tts or to the OpenAI-compatible API endpoint you configure. Avoid putting secrets or private regulated data in text to synthesize, use a trusted HTTPS API URL, prefer environment variables over command-line API keys, and consider pinning dependencies in a virtual environment before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tts_simple.py:103
Finding: Unrestricted API Endpoint Can Receive API Credentials and User-Supplied Text
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:11
Finding: Unpinned Third-Party Dependencies Allow Non-Reproducible and Potentially Unsafe Installations
Content: View full analysis
=7.0.0 # ── API Support ─────────────────────────────────────────────────────────────── # For OpenAI-compatible API TTS openai>=1.0.0 # ── Audio Conversion ───────────────────────────────────────────────────────── # av (PyAV): audio/video conversion, required for OGG/Opus conversion av>=10.0.0 # ── Core ───────────────────────────────────────────────────────────────────── aiohttp>=3.8.0 ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. A command such as `pip install -r requirements.txt` may therefore install any later release accepted by the resolver. The file also lacks package hashes and does not lock transitive dependencies. This creates non-reproducible installations and expands supply-chain exposure. If a dependency account, release process, package artifact, or transitive dependency is compromised, a future installation can automatically select the affected release without any project change or review. Python package installation may execute package build logic, while imported dependencies execute with the same privileges as the TTS script at runtime. The reviewed dependency names correspond to the functionality implemented by the project; no evidence in the available files establishes that any listed package is currently malicious. The finding concerns unsafe dependency constraints and absent artifact verification. ### Attack Path 1. A listed package or one of its transitive dependencies publishes a compromised or otherwise unsafe later release. 2. A user follows the documented instruction to run `pip install -r requirements.txt`. 3. Because the constraints specify only minimum versions, the package resolver selects t ...[truncated 910 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill documents capabilities that read environment variables, read files, and write output files, but it does not declare any tool scope or permission boundary. In an agent ecosystem, missing explicit scope can cause the orchestrator or reviewer to underestimate what the skill can access, increasing the chance of unintended file or secret exposure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes broad natural-language phrases like '语音回复' and '语音对话' that could match ordinary conversation and invoke the skill unexpectedly. Because this skill can write files and send user text to external TTS services, overbroad activation raises the risk of accidental data processing or transmission without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill supports online synthesis via Microsoft edge-tts and OpenAI-compatible APIs, but the description does not prominently warn that input text may be transmitted to third-party services. Users may provide sensitive content expecting local processing, causing unintentional disclosure of private or regulated data.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
使用 API

python3 scripts/tts_simple.py "你好" --engine api
--api-url https://api.openai.com/v1
--api-key sk-xxx
--voice alloy

text

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
# Install: pip install -r requirements.txt # # ⚠️ System dependencies required (install separately): # Ubuntu/Debian: sudo apt install ffmpeg libopus-tools # macOS: brew install ffmpeg # Windows: download ffmpeg and add to PATH

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This script sends user-provided text to the external edge-tts service for synthesis, which means potentially sensitive content leaves the local environment. The code and metadata describe an online TTS backend, but there is no explicit warning, consent prompt, or privacy notice at the point of transmission, so users may unknowingly disclose confidential text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The function default sets voice="zh-CN-XiaoxiaoNeural", which imposes a specific language/locale choice by default. The file does not document that this locale is required for a region-specific purpose or ask the user to opt in before using it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The command-line interface defaults --voice to zh-CN-XiaoxiaoNeural, meaning the skill will use a specific language/locale unless the user overrides it. This is a natural-language locale policy concern because no opt-in or documented justification is provided in the file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest states edge-tts performs online synthesis, while the inline dependency comment labels it as "offline." This is a direct documentation contradiction about how the TTS backend operates, which could mislead users about network usage and runtime behavior.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: Using a lower-bound version specifier for edge-tts allows future releases to be installed automatically, which can introduce breaking changes or newly vulnerable versions without review. In a supply-chain context, this reduces build reproducibility and makes it harder to verify exactly what code is deployed.
Content: Scanner excerpt · requirements.txt (reported line 11)May include surrounding context.
text
# ── Core TTS ───────────────────────────────────────────────────────────────── # edge-tts: Microsoft Neural TTS (free, high quality, offline) edge-tts>=7.0.0 # ── API Support ─────────────────────────────────────────────────────────────── # For OpenAI-compatible API TTS

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: An unpinned openai dependency permits installation of any later major/minor release satisfying the constraint, creating supply-chain and reproducibility risk. If a compromised or incompatible version is resolved, the skill could behave unexpectedly or inherit vulnerable transitive code.
Content: Scanner excerpt · requirements.txt (reported line 15)May include surrounding context.
text
# ── API Support ─────────────────────────────────────────────────────────────── # For OpenAI-compatible API TTS openai>=1.0.0 # ── Audio Conversion ───────────────────────────────────────────────────────── # av (PyAV): audio/video conversion, required for OGG/Opus conversion

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The av package is unpinned, so builds may resolve to different versions over time, which is particularly relevant for media-processing libraries that often wrap complex native components. This increases supply-chain exposure and makes it difficult to guarantee that deployed environments are free from known defects.
Content: Scanner excerpt · requirements.txt (reported line 19)May include surrounding context.
text
# ── Audio Conversion ───────────────────────────────────────────────────────── # av (PyAV): audio/video conversion, required for OGG/Opus conversion av>=10.0.0 # ── Core ───────────────────────────────────────────────────────────────────── aiohttp>=3.8.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Leaving aiohttp unpinned exposes the skill to non-deterministic dependency resolution and potential installation of versions affected by known advisories. Because aiohttp is a network-facing library, unresolved version drift can materially increase attack surface if vulnerable releases are pulled in.
Content: Scanner excerpt · requirements.txt (reported line 22)May include surrounding context.
text
av>=10.0.0 # ── Core ───────────────────────────────────────────────────────────────────── aiohttp>=3.8.0

Unverifiable Dependency: aiohttp has 16 known advisory(ies) (CVE-2024-52303 (aiohttp has a memory leak when middleware is enabled when requesting a resource ); CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The manifest references aiohttp without pinning a version even though the package has multiple known advisories, making it impossible to determine from this file whether installations will be safe. In a skill that performs network operations, an affected aiohttp version could expose the runtime to request-handling, header-injection, cookie, or denial-of-service issues depending on actual usage.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The argument help says the output audio file may be ".ogg for voice, .mp3 for API" and exposes a --keep-mp3 flag, implying API mode can retain MP3 output. In practice, tts_with_api always writes MP3 temporarily, converts it to OGG, deletes the MP3, and the --keep-mp3 flag is never used, so the documentation contradicts actual behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp2

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

External Transmission

使用 API

Sudo/Root Execution

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

Intent-Code Divergence

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Intent-Code Divergence

Static analysis