Security audit

Voice Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill’s voice workflow is mostly coherent, but it can overwrite arbitrary writable files and sends synthesized text through an AWS-backed path without strong user-facing privacy or output-safety controls.

Review before installing. Use this only with a trusted localhost backend, avoid sending sensitive text to synthesis unless AWS Polly processing is acceptable, and direct generated audio only to a dedicated output folder with non-sensitive filenames. Do not ask the agent to transcribe very large files or special device paths.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/client.py:90
Finding: Arbitrary Writable-File Overwrite Through Unrestricted Synthesis Output Path
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/client.py:43
Finding: Unbounded Multipart Upload Buffering Enables Memory Exhaustion
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes a local backend over HTTP and AWS-backed synthesis via a client script, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: an agent may be able to perform network-capable actions the user or platform did not explicitly approve, increasing the risk of unintended outbound communication or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that it uses AWS Polly for text-to-speech but does not clearly warn users that text passed to synthesis may be transmitted to a third-party cloud provider. This can expose sensitive prompts, personal data, or agent-generated content to external processing without informed user consent, which is especially risky in a voice workflow where users may assume processing is local.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.