ClawHub
Back to skill

Security audit

Local TTS

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent text-to-speech skill with a disclosed online default engine and an offline option, though users should avoid sending sensitive text to the online engine.

Install only if you are comfortable using an online Microsoft-based TTS engine by default. Use --offline for secrets, private documents, regulated data, or proprietary text, and choose explicit output paths if you do not want audio files saved in the skill directory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README promotes `edge-tts` as the default network-based engine but does not clearly disclose that input text may be transmitted to an external Microsoft service for synthesis. In an agent setting, users may provide sensitive prompts, secrets, or proprietary content, so this omission can lead to unintended data exfiltration and privacy/compliance violations.

Static analysis

No suspicious patterns detected.