T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:16- Finding
Remote Installer Is Downloaded and Executed Without Independent Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Ai Voice Cloning
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed cloud voice-generation helper, but its install and related-skill commands rely on mutable remote code without independent verification.
Review this before installing. Prefer downloading and verifying the inference.sh CLI through pinned, versioned artifacts instead of running the pipe-to-shell command, avoid entering sensitive text or private media unless you trust the provider's handling, and treat the related npx skill installs as separate dependencies that should be pinned and reviewed independently.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:258- Finding
Unpinned Third-Party Skill Installation Commands Create Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl ... | shexecutes remote script content directly from the network without requiring users to inspect or independently verify the exact script being run at execution time. If the hosting endpoint, CDN, TLS termination, or upstream distribution pipeline is compromised, users could execute arbitrary code on their systems; the surrounding reassurance text does not eliminate that risk.- Content
Quick Start
bash curl -fsSL https://cli.inference.sh | sh && infsh login # Generate speech infsh app run infsh/kokoro-tts --input '{
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger list in the description includes broad phrases such as "tts," "ai voice," "narration," and "natural voice," which are common terms that could match many unrelated user requests. The file does not provide narrowing context, explicit activation constraints, or negative examples to reduce accidental invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages use of external inference services for text, audio, image, and video workflows without clearly warning that user-provided content may be uploaded to third-party systems. This can lead to inadvertent disclosure of sensitive prompts, copyrighted text, voice samples, portraits, or media, especially because the skill also demonstrates media-merger and avatar workflows beyond plain TTS.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes an AI voice generation/text-to-speech skill, but the documented workflows also invoke
infsh/media-mergerto merge audio/video andbytedance/omnihuman-1-5to create a talking-head avatar. Those are broader media composition and animation capabilities, not merely implementation details of TTS.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The 'Create Talking Head' example uses
bytedance/omnihuman-1-5with an image and generated audio to animate an avatar. Creating talking-head video is a distinct capability from voice synthesis and is not declared in the manifest's stated purpose.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.