Audiobook

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:53 AM UTC
• Version: 0.1.4

Overview

This skill is a disclosed audiobook-production workflow, with the main risk being expected third-party processing of story text and voice audio through Step-compatible APIs.

Install only if you are comfortable sending manuscripts, role/casting data, and selected voice audio to StepFun or any endpoint you configure. Use a limited STEP_API_KEY, review any .env and base_url settings before running, keep clone_selected_voices.py in dry-run until you intend paid cloning, and treat --force as an overwrite action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (133)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code chunk does relate to audiobook preprocessing, but its primary behavior is narrower and materially different from the declared description. It does not manage voices, perform TTS, sync voices, analyze cloned voices, synthesize audio segments, or export final audiobooks. Instead, it transforms raw text into a structured script using LLM calls, with chunk planning, chapter detection, normalization of characters/segments, checkpoint resume logic, and artifact persistence. While 'LLM casting' is loosely adjacent, even that is not the main function shown here; the main function is structured script generation. Therefore the description does not accurately represent what this specific code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code chunk does not implement audiobook, voice-library, TTS, synthesis, sync, or export functionality. Its primary behavior is a networked utility for calling an OpenAI-compatible API, extracting text/reasoning fields, parsing JSON from responses, retrying when JSON is malformed, and invoking a repair prompt. While the description mentions 'LLM casting,' this code is far broader as a generic LLM JSON helper and does not specifically support the core declared audiobook/voice-management functions. Therefore the description materially misrepresents this code chunk's actual purpose.

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/sync_voice_library.py --library "$VOICE_LIBRARY" --input /绝对路径/参考音频.m4a

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/sync_voice_library.py --library "$VOICE_LIBRARY" --input /绝对路径/参考音频.m4a

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/sync_voice_library.py --library "$VOICE_LIBRARY" --input /绝对路径/参考音频.m4a

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/generate_structured_script.py --library "$VOICE_LIBRARY" --input /绝对路径/小说.txt

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/generate_structured_script.py --library "$VOICE_LIBRARY" --input /绝对路径/小说.txt

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tainted flow: 'request' from pathlib.Path.read_bytes (line 136, file read) → urllib.request.urlopen (network output)

High

• Category: Data Flow

Content

def request_json(request: urllib.request.Request, error_prefix: str) -> dict[str, Any]:
    try:
        with urllib.request.urlopen(request) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.HTTPError as error:
        text = error.read().decode("utf-8", errors="replace")

• Confidence: 80% confidence
• Finding: File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Credential Access

High

• Category: Privilege Escalation

Content

if normalized_kind == "process_env":
        return f"process.env.{env_key}"
    if normalized_kind == "dotenv":
        # Keep the provenance signal, but never expose the real .env path.
        return f"dotenv:.env:{env_key}"
    return normalized_kind or "unknown"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

visited: set[Path] = set()
    for directory in search_dirs:
        env_path = find_upward(directory, ".env")
        if not env_path or env_path in visited:
            continue
        visited.add(env_path)

• Confidence: 90% confidence
• Finding: This code searches upward through directories for a .env file and reads it to extract credentials, which is a form of credential access. In this skill, that behavior is risky because it may collect secrets from a broader developer or agent workspace than intended, creating opportunities for unintended use, leakage, or privilege expansion.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Step-specific audio capabilities keep using Step native APIs, such as `step-audio-r1.1`, the official voice API, the voice cloning API, and `stepaudio-2.5-tts`
- long-text understanding, role analysis, and casting reasoning use `step-3.5` by default
- the default `step-3.5` call uses Step's `step_plan` reasoning endpoint at `https://api.stepfun.com/step_plan/v1`
- the LLM understanding layer is intentionally implemented through a configurable compatibility layer so it can later switch to another compatible LLM
- intermediate artifacts are written to disk by default so humans can review them and programs can resume from any stage

• Confidence: 92% confidence
• Finding: The skill explicitly states that story text, audio-derived metadata, and related workflow data are sent to external StepFun APIs for reasoning, audio analysis, cloning, and TTS. This creates a real data exfiltration boundary because potentially sensitive local content is transmitted off-host; the risk is increased by the configurable compatibility endpoint, which could redirect LLM-bound content to another service if misconfigured.

External Transmission

Medium

• Category: Data Exfiltration

Content

One important clarification is that not every part of the skill is meant to be replaceable.

- replaceable by default: long-text structuring, role extraction, casting reasoning, and related LLM understanding tasks
- these tasks currently default to `step-3.5`, using `https://api.stepfun.com/step_plan/v1`
- not replaced by default: `step-audio-r1.1` audio analysis, Step official voice sync, Step voice cloning, and `stepaudio-2.5-tts` synthesis
- in other words, `audiobook` is currently designed as Step-native audio capability plus a configurable reasoning layer, not as a completely provider-agnostic abstraction for every feature

• Confidence: 93% confidence
• Finding: This section reaffirms that multiple workflow stages send local content to `https://api.stepfun.com/step_plan/v1` and other Step-native services, making the external transmission behavior intentional and central to the skill. Because the skill processes raw story files and voice data, the transmission may expose copyrighted, private, or regulated material to third-party infrastructure.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Prefer a test key, a limited-scope key, or at least rotate the key after first validation. If you do not fully trust the current setup, run the workflow in a sandbox or isolated environment first.
- Install `ffmpeg` and `ffprobe` only from trusted sources.
- The only step that may trigger paid billing is `clone_selected_voices.py`; and now, besides `selected_for_clone=true`, it also requires an explicit `--confirm-paid-action` flag before a real clone is executed.
- `run_audiobook.py` only performs a clone preview with `--dry-run` by default and does not automatically perform the real paid clone for you.
- If you are auditing the skill, or want to verify the default endpoints and environment-variable usage, read `references/security.en.md`.

If `voice-library.yaml` does not exist yet, initialize it from the template:

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

If `voice-library.yaml` does not exist yet, initialize it from the template:

```bash
mkdir -p "$LIBRARY_ROOT"
cp       "$SKILL_ROOT/assets/voice-library.template.yaml"       "$VOICE_LIBRARY"
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill explicitly documents capabilities that read and write local files, invoke shell commands, access environment secrets (`STEP_API_KEY`), and make outbound network requests, but it declares no `permissions` or `allowed-tools` scope. That omission weakens containment and makes accidental or unsafe invocation more likely, especially for a workflow that can touch persistent user data and external paid APIs.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Step 专属能力继续使用 Step 的原生接口，例如 `step-audio-r1.1`、官方音色接口、音色复刻接口、`stepaudio-2.5-tts`
- 需要长文本理解、角色分析、选角推理的部分，默认使用 `step-3.5`
- 当前默认的 `step-3.5` 调用走的是 Step 的 `step_plan` reasoning 接口，默认 endpoint 为 `https://api.stepfun.com/step_plan/v1`
- 上述 LLM 理解层尽量通过可配置的兼容层实现，便于后续按需替换为其他兼容的 LLM
- 各阶段中间产物默认落盘，既方便人工审阅和修改，也方便程序按阶段接续执行

• Confidence: 95% confidence
• Finding: The skill sends content to external Step APIs, including long text for script analysis and possibly audio-related data for voice analysis/TTS workflows. This is dangerous because user-provided stories, voice samples, metadata, and potentially sensitive local content may be transmitted off-host to third-party services, creating privacy, compliance, and data-governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

当前需要重点说明的是：并不是整个 skill 的所有能力都可以替换成别的模型。

- 默认可替换的部分：长文本结构化、角色提取、选角推理等 LLM 理解环节
- 这些环节当前默认使用 `step-3.5`，且默认走 `https://api.stepfun.com/step_plan/v1`
- 默认不替换的部分：`step-audio-r1.1` 音频分析、Step 官方音色拉取、Step 音色复刻、`stepaudio-2.5-tts` 合成
- 也就是说，`audiobook` 当前是“Step 音频能力 + 可替换 LLM 推理层”的组合架构，而不是把所有能力都抽象成完全可替换的通用 provider

• Confidence: 96% confidence
• Finding: The skill allows the LLM reasoning layer to be redirected to a configurable 'compatible' endpoint, which materially increases exfiltration and SSRF-like risk if the base URL is changed to an untrusted service. In this context, the skill may send large story texts, character data, and workflow artifacts to whichever endpoint is configured, so a malicious or mistaken configuration could leak sensitive material or route requests to unintended internal/external systems.

Session Persistence

Medium

• Category: Rogue Agent

Content

如果本地还没有 `voice-library.yaml`，先用模板初始化：

```bash
mkdir -p "$LIBRARY_ROOT"
cp \
  "$SKILL_ROOT/assets/voice-library.template.yaml" \
  "$VOICE_LIBRARY"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

如果本地还没有 `voice-library.yaml`,先用模板初始化:

```bash
mkdir -p "$LIBRARY_ROOT"
cp \
  "$SKILL_ROOT/assets/voice-library.template.yaml" \
  "$VOICE_LIBRARY"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

defaults:
    provider: "openai_compatible"
    api_key_env: "STEP_API_KEY"
    base_url: "https://api.stepfun.com/step_plan/v1"
    temperature: 0.2
    max_tokens: 6000
  tasks:

• Confidence: 90% confidence
• Finding: The template configures an external base_url for an OpenAI-compatible provider, enabling story text, casting data, and potentially voice-related metadata to be sent to a third-party service during normal operation. In this skill context, that is expected functionality, but it still creates a real data egress boundary and privacy/compliance risk if sensitive manuscript or voice data is processed without explicit user awareness and controls.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: This manifest-like YAML is subject to policy checks for natural-language constraints. The profile metadata and descriptions are presented only in Chinese, and the voice traits explicitly constrain accent to "普通话" in both profiles, which indicates a fixed language/locale expectation without opt-in or justification.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that edits to clone-review.yaml are synchronized back into voice-library.yaml and can drive paid cloning decisions, but it does not require an explicit cost warning or confirmation step at the point of change. In this skill context, that creates a real risk of unintended billing or irreversible workflow changes because a user may treat the refresh step as routine state sync rather than an action that affects paid clone selection.

External Transmission

Medium

• Category: Data Exfiltration

Content

- 默认是 Step 3.5
- 当前默认的 `step-3.5` 调用走的是 Step 的 `step_plan` 推理接口
- 默认 endpoint 为 `https://api.stepfun.com/step_plan/v1`
- 但后续可以切到别的 OpenAI-compatible 模型
- 文档和代码都尽量避免把规则写死成大量正则 + 权重打分

• Confidence: 90% confidence
• Finding: The file documents a concrete external API endpoint for LLM inference, which implies that structured scripts and casting-related data may leave the local environment and be sent to a third party. In the audiobook context, that can expose proprietary manuscripts, character descriptions, and voice-library metadata if operators are unaware or if no consent/data-classification checks exist.

Session Persistence

Medium

• Category: Rogue Agent

Content

python3 scripts/synthesize_tts_requests.py --input /absolute/path/<base>.tts-requests.json --only-failed
```

### I want to force overwrite segments that already succeeded

```bash
python3 scripts/synthesize_tts_requests.py --input /absolute/path/<base>.tts-requests.json --force

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file instructs users to run commands with `--force` for synthesis and finalization, which strongly implies overwriting existing outputs. Although the section titles mention "force," the document does not clearly warn that these operations may replace previously successful segments or exported artifacts, which could affect user data and work product.

Static analysis

No suspicious patterns detected.