gemini-3.1-flash-tts

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 2:18 PM UTC
• Version: 1.0.11

Overview

This skill is a disclosed Replicate text-to-speech helper; it uses an API token and sends the user's script to Replicate as expected for generating audio.

Install only if you trust the PrunaAI skill source and Replicate. Expect your script, style prompt, selected voice, language code, and Replicate token-authenticated request to be sent to Replicate for audio generation. Review the recommended npx-installed companion skills because they are additional code/content pulled from a remote source.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs the agent/user to run `npx skills add ...` without pinning the `skills` runner itself to a specific version or digest. That creates a supply-chain trust gap: future changes or compromise of the fetched package could alter behavior at install/runtime and execute unexpected code in the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

## HTTP (curl)

```bash
curl -s -X POST \
  -H "Authorization: Bearer ${REPLICATE_API_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"language_code": "en-US"
    }
  }' \
  "https://api.replicate.com/v1/models/google/gemini-3.1-flash-tts/predictions"
```

Poll `urls.get` until `status` is `succeeded`; download `output` (audio URL). Shared client: follow `pruna-api` (Replicate HTTP in the tool skill).

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The markdown specifies `language_code` with a default of `en-US`, which imposes a language/locale choice unless the user overrides it. For a general-purpose TTS skill, this can conflict with locale-choice policy unless the default is explicitly presented as user-selectable or context-limited.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.