T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:36- Finding
Unverified Remote Installer Is Piped Directly Into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Telegram Offline Voice
Security checks for vulnerabilities and agentic risk
Overview
The skill is a voice-generation helper, but it makes local/offline privacy claims while using an online TTS service and recommends unsafe installer commands.
Review this skill before installing. Do not use it for secrets, private messages, or confidential work unless you are comfortable sending the text to Microsoft Edge-TTS. Avoid the curl-to-sh uv installer unless you independently trust and verify it, and run sudo package installation only on a machine where system package changes are acceptable.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/voice_gen.py:2- Finding
Runtime Dependencies Are Unpinned and Automatically Resolved
- Content
View full analysis
=3.10" # dependencies = [ # "edge-tts", # "aiofiles", # ] # /// ``` The documented invocation that triggers resolution is: ```bash uv run {baseDir}/scripts/voice_gen.py --text "..." ``` ### Technical Analysis The PEP 723 dependency declarations specify package names without exact versions or hashes. When `uv run` prepares the script environment, it may resolve and download whatever package versions currently satisfy these unrestricted declarations. Consequently, execution is not reproducible and the reviewed Skill does not fully determine the code that will run. A compromised future package release, upstream account compromise, or unexpected incompatible update could introduce attacker-controlled or unsafe behavior. The declared `aiofiles` package is not imported or directly used by the script, unnecessarily increasing the dependency and supply-chain surface. ### Attack Path 1. An attacker compromises the publishing account or distribution process for a declared dependency. 2. The attacker publishes a malicious version under the legitimate package name. 3. A user or Agent runs the documented `uv run` command without a previously locked environment. 4. The resolver selects and downloads the malicious release because no exact version or trusted hash is required. 5. Package code executes during environment setup or subsequent import. 6. The package gains the privileges and data access of the user running the Skill. ### Impact Assessment A malicious dependency can execute Python code with the invoking user's permissions. It may access the input text, generated audio, local files, environment variables, credentials, and network resources available to that account. The scope is normally u ...[truncated 237 chars]- Remediation
View remediation
other
Warning
- Location
scripts/voice_gen.py:63- Finding
Input Text Is Sent to an Online TTS Service Despite Offline Privacy Claims
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (16)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
1. 安装依赖
bash sudo apt update && sudo apt install ffmpeg python3-pip -y2. 运行生成
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
1. 安装依赖
bash sudo apt update && sudo apt install ffmpeg python3-pip -y2. 运行生成
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation repeatedly claims the solution is 'completely offline' and '100% local' while relying on Microsoft Edge-TTS, which typically uses a remote service rather than an offline local synthesis engine. This is dangerous because users may provide sensitive text under false privacy assumptions, leading to unintended data disclosure to third-party infrastructure.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Piping downloaded content directly into sh is a classic command-chaining pattern that turns remote content retrieval into immediate code execution with no review step. This is especially dangerous in a skill document because agents or users may copy it verbatim, leading to fast-path compromise if the source is malicious or tampered with.
- Content
sudo apt update && sudo apt install ffmpeg python3-pip -y
推荐安装 uv 以极速运行封装脚本
curl -LsSf https://astral.sh/uv/install.sh | sh
text ## 🚀 使用方法 (推荐)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is described as local/offline voice generation, but it imports and uses edge-tts, which sends input text to an external service for synthesis. This creates a significant trust and privacy gap: users may provide sensitive text believing it never leaves the host, when it is actually transmitted off-device.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill documentation is presented entirely in Chinese, including the core description and usage guidance, with no indication that other languages are supported or that Chinese is a deliberate region-specific requirement. This can violate language/locale policy when a skill imposes a specific language without user opt-in or justification.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
1. 安装依赖
bash sudo apt update && sudo apt install ffmpeg python3-pip -y2. 运行生成
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents shell-based installation and execution steps but does not declare any explicit tool scope or allowed-tools boundary. This increases the chance that an agent may invoke shell commands without clear sandboxing or user awareness, which is risky for a skill that installs packages and runs local scripts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description states the skill uses '高质量中文语音', which hard-codes Chinese output as the intended language. Under the policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill instructs users or agents to run package installation commands with sudo, which requires elevated privileges and expands the blast radius of any mistake or compromise. In agent-assisted environments, encouraging privileged execution is dangerous because it can normalize unnecessary root access for routine setup tasks.
- Content
bash # 需要 Python 环境和 FFmpeg sudo apt update && sudo apt install ffmpeg python3-pip -y # 推荐安装 uv 以极速运行封装脚本 curl -LsSf https://astral.sh/uv/install.sh | sh
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code path that generates speech depends on edge_tts.Communicate(...).save(...), which requires an online service despite the skill being positioned as local. In this context, the mismatch is security-relevant because it can cause unintentional disclosure of user-provided content and violate deployment assumptions in restricted or privacy-sensitive environments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
User-supplied text is sent to an external TTS service without any warning, consent prompt, or visible disclosure in the script. This is dangerous because users may include secrets, personal data, or internal content, and the skill context specifically increases risk by advertising local/offline processing.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-ac", "1", "-ar", "48000", "-application", "voip", str(output_path) ] subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) async def main(): parser = argparse.ArgumentParser(description="Smart Voice Generator for Telegram")
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file includes a command that updates package indexes and installs system packages using sudo, which affects system state and may require elevated privileges. The surrounding text does not warn users that the command will modify their system or require administrator access.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation fetches and executes a remote install script directly via curl piped to sh, which bypasses integrity verification and executes whatever the remote server returns. If the upstream source, transport, or DNS path is compromised, this becomes arbitrary code execution on the host.
- Content
sudo apt update && sudo apt install ffmpeg python3-pip -y
推荐安装 uv 以极速运行封装脚本
curl -LsSf https://astral.sh/uv/install.sh | sh
text ## 🚀 使用方法 (推荐)
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The default voice is hard-coded to
zh-CN-XiaoxiaoNeural, which imposes a specific language/locale when the user does not explicitly choose one. This can violate language/locale policy expectations because the tool selects a locale-specific output by default rather than prompting or using a neutral default.- Content