Vocal Chat

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:49 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it turns WhatsApp voice messages into text and sends local voice replies, with a small temp-file safety caveat.

Before installing, make sure users expect their WhatsApp voice notes to be transcribed and answered by the agent. Prefer changing the example to use a private unique temporary file and deleting generated audio after sending.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:33

Finding

Predictable Shared Temporary File Path for Generated Voice Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–37
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

bin/sherpa-onnx-tts /tmp/reply.ogg "Tu mensaje aquí"

The instructions subsequently require the agent to send /tmp/reply.ogg through the messaging tool:

text

Then send `/tmp/reply.ogg` via `message` tool with `filePath`.

Technical Analysis

The documented workflow writes generated speech to a fixed, predictable filename in the globally shared /tmp directory. In a multi-user or otherwise untrusted local environment, another process may create, replace, or manipulate /tmp/reply.ogg before or between the generation and sending operations.

If sherpa-onnx-tts follows symbolic links when opening its output, an attacker may pre-create /tmp/reply.ogg as a symbolic link to another file writable by the agent. A time-of-check/time-of-use race may also allow the generated file to be replaced after synthesis but before it is submitted to the messaging tool. The exact overwrite behavior depends on the implementation of the referenced TTS binary, which is not included in the supplied artifact.

Attack Path

1. A local attacker with access to the shared temporary directory predicts the documented /tmp/reply.ogg path.
2. The attacker creates that path as a symbolic link to a file writable by the agent, or continuously replaces the path to win a race.
3. The agent executes the documented TTS command.
4. If the TTS utility follows the link, it writes to the linked destination instead of an isolated output file.
5. Alternatively, the attacker replaces the completed audio file before the messaging operation.
6. The agent may overwrite an unintended file or send attacker-controlled audio to the WhatsApp recipient.

Exploitation requires local access sufficient to manipulate entries in the relevant temporary directory and depends partl ...[truncated 613 chars]

Remediation

View remediation

Remediation Suggestions

• Create a private temporary directory with permissions restricted to the agent process, such as mode 0700.
• Generate a cryptographically unpredictable filename using a secure temporary-file facility such as mktemp.
• Open output files with exclusive-creation and no-symbolic-link protections where supported.
• Verify immediately before sending that the output is a regular file owned by the expected user and located inside the private directory.
• Pass an already-open file descriptor to downstream components where possible to eliminate path replacement races.
• Delete the generated audio and private temporary directory after the send operation, including on failures.
• Avoid reusing output paths across requests or concurrent conversations.

Example hardened shell workflow:

bash

tmp_dir="$(mktemp -d)"
chmod 700 "$tmp_dir"
output="$tmp_dir/reply.ogg"
trap 'rm -rf -- "$tmp_dir"' EXIT

bin/sherpa-onnx-tts "$output" "Tu mensaje aquí"
test -f "$output" && test ! -L "$output"

The messaging tool should then receive the unique $output path only after these checks succeed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly automates transcription of incoming voice messages and generation of return audio, but it does not warn users that their audio will be automatically processed and transformed. This creates a privacy and consent risk because users may not expect automatic speech-to-text handling, retention of transcripts, or voice-response automation, especially in messaging contexts where sensitive information is often shared.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.