Microsoft Edge TTS

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.0

Overview

This TTS skill is coherent, but it tells users to run an unpinned npm package that can change over time and sends spoken text to an online Microsoft service.

Review before installing. Use this only for text you are comfortable sending to Microsoft Edge's online TTS service, and prefer a pinned, reviewed node-edge-tts version installed through a lockfile or sandbox instead of copying the unpinned npx examples.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–39; additional instances at lines 106–108 and 114–120
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

# Basic usage
npx node-edge-tts -t 'Hello World'

# Specify output file
npx node-edge-tts -t 'Hello World' -f './output.mp3'

# Specify voice and language
npx node-edge-tts -t 'Hello world' -v 'en-US-AriaNeural' -l 'en-US'

# Adjust speaking rate and pitch
npx node-edge-tts -t 'Hello World' -r '+10%' --pitch '-5%'

# Generate subtitle file
npx node-edge-tts -t 'Hello World' -s

Technical Analysis

The documented commands invoke node-edge-tts through npx without specifying an exact package version. The project contains no package.json, lockfile, integrity hash, vendored dependency, or other mechanism that fixes and verifies the artifact being executed.

When the package is not already available locally, npx may retrieve its current release from the configured npm registry and immediately execute package lifecycle or runtime code. Consequently, the code executed by these instructions can change after the skill has been reviewed. This creates a supply-chain exposure if the package, its dependencies, its publisher account, or the configured package registry is compromised.

The finding does not establish that node-edge-tts is currently malicious. The vulnerability is the unsafe, mutable dependency execution pattern documented by the skill.

Attack Path

1. An attacker compromises the npm package, one of its transitive dependencies, a maintainer account, or the package registry used by the victim.
2. The attacker publishes a malicious or compromised version under the package name expected by the documented command.
3. A user or agent follows the skill instructions and executes npx node-edge-tts without an exact version or trusted lockfile.
4. npx downloads t ...[truncated 1018 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a package.json that pins node-edge-tts to a reviewed, exact version rather than using a range or implicit latest release.
2. Generate and commit the corresponding npm lockfile so the complete transitive dependency graph and integrity metadata are recorded.
3. Install dependencies using a lockfile-enforcing workflow such as npm ci.
4. Replace ad hoc npx node-edge-tts instructions with invocation of the audited local binary, such as ./node_modules/.bin/node-edge-tts.
5. If npx must be retained, specify an exact reviewed version and configure it not to silently substitute an unreviewed package.
6. Verify package provenance, publisher ownership, integrity metadata, and transitive dependencies before approving upgrades.
7. Run TTS generation with least privilege in a sandbox or container that has restricted filesystem access, no unnecessary secrets, and limited outbound networking.
8. Document that submitted text is sent to an external online TTS service so users can avoid processing confidential content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description does not clearly warn that user-supplied text is sent to Microsoft's online TTS service. This omission creates a privacy and data-handling risk because users may provide sensitive text under the assumption that processing is local.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list includes broad natural-language phrases such as Read aloud, which can match common user requests and cause the skill to activate when the user did not explicitly intend to use this external online TTS path. In this skill, unintended activation matters because it may send user content to a third-party service and may cause surprise tool execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx node-edge-tts without pinning a specific package version allows whatever version is currently published to npm to be fetched and executed at runtime. If the package is compromised, typo-squatted, or updated with malicious code, users following the skill instructions could execute untrusted code on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This example invokes npx without a pinned version, which causes dynamic retrieval and execution of the latest published package. That creates a supply-chain execution path where a malicious or compromised release can run arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

An unpinned npx command executes code from the npm registry based on the current latest version, not a reviewed release. In a skill document, this is dangerous because users may copy-paste the command directly and unknowingly run compromised package code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Because npx node-edge-tts is not version constrained, the command may fetch and execute newly published code that has not been security reviewed by the skill author. This is a classic software supply-chain risk and can lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This command demonstrates direct execution of an npm package through npx without pinning, which exposes users to package compromise and malicious upstream updates. Since the skill encourages copy-paste usage, exploitation would be straightforward if the package or dependency chain were hijacked.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented defaults set the voice to zh-CN-XiaoyiNeural and language to zh-CN, which imposes a specific locale when the user has not selected one. This can violate language/locale policy expectations unless the skill explicitly asks for user preference or clearly justifies the locale constraint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The example at this line again relies on unpinned npx execution, which means code provenance is not stable across time. A malicious release or dependency compromise could convert a benign TTS action into arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This sample command uses npx without an exact version, creating a supply-chain trust gap where future package changes immediately affect users. In practice, an attacker who gains publish access could weaponize the command path to execute code during normal skill use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

As with the other examples, this unpinned npx invocation can retrieve and run a different package build over time, making the instruction non-reproducible and unsafe. The risk is elevated because end users are likely to execute the exact command without additional validation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.