Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Replicate text-to-speech guide with disclosed API use and no hidden execution or persistence, though users should review the unpinned install examples.
Install only if you are comfortable using Replicate for TTS and sending the selected script and prompt to Replicate's API. Review the related-skill install commands before running them, prefer trusted or pinned installation sources where available, and keep `REPLICATE_API_TOKEN` scoped and private.
The skill instructs users to execute npx skills add ... without pinning the skills package/tool version. This creates a supply-chain risk because whatever version resolves at execution time may change behavior or introduce malicious code, and the skill encourages repeated installs of additional packages.
This line references npx skills without a pinned version, so users may execute an unintended or newly published version of the tool. In an agent skill, install instructions are especially sensitive because they can lead directly to code execution on the operator's machine.
Unpinned npx skills usage exposes consumers to supply-chain drift and possible malicious package substitution. Because the skill chains to other skills, a compromised installer could broaden impact beyond this single capability.
The install command relies on npx resolving the latest available skills tool, which is not reproducible or trustworthy by default. An attacker controlling or poisoning the upstream package path could achieve arbitrary code execution during installation.
The full-suite install example also uses unpinned npx skills, carrying the same supply-chain execution risk as the prerequisite lines. The broader install may increase blast radius because it pulls a larger package set.
This alternate-skill install instruction again uses unversioned npx skills, which can execute arbitrary code from whatever package version is resolved at runtime. Repetition across the document increases the chance an operator will run one of these unsafe commands.
The command invokes npx skills without a pinned version, making the installation non-deterministic and vulnerable to upstream compromise. Since this is presented as normal workflow guidance, users may trust and execute it without review.
As with the other install examples, this line permits floating dependency resolution and associated supply-chain risk. In skill ecosystems, dependency chaining can turn a single compromised package into broad agent compromise.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -X POST \
-H "Authorization: Bearer ${REPLICATE_API_TOKEN}" \
-H "Content-Type: application/json" \
-d '{
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"language_code": "en-US"
}
}'
"https://api.replicate.com/v1/models/google/gemini-3.1-flash-tts/predictions"
Poll `urls.get` until `status` is `succeeded`; download `output` (audio URL). Shared client: follow `pruna-api` (Replicate HTTP in the tool skill).
The follow-on skill installation recommendation uses unpinned npx skills, again exposing users to arbitrary upstream changes or malicious package resolution. Because it is a next-step recommendation, it may be executed in sequence after initial trust has been established.
This line repeats the same unpinned installer pattern, which is a genuine supply-chain weakness rather than a harmless style issue. Any compromise of the package or resolution path could result in local code execution during install.
The instruction references npx skills without version locking, so the actual code executed can differ over time. That undermines reproducibility and creates avoidable supply-chain exposure for users of the skill.
Another unpinned installer command appears in the skill's next-step guidance, which can normalize unsafe execution behavior. Attackers benefit when documentation trains users to run mutable bootstrap commands directly.
This final install example still uses a floating npx skills invocation, preserving the same package-resolution risk. The cumulative pattern across many lines increases operational exposure even if intent appears non-malicious.
No suspicious patterns detected.