T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:251- Finding
Synthesized Audio Remains in Persistent Temporary Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Elderly Voice Assistant
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for a voice assistant, but it handles sensitive voice and family-care actions without enough consent, confirmation, or data-retention controls.
Review this carefully before installing. It should require explicit setup for family contacts, inactivity monitoring, and message sending; read back messages before sending; disclose that voice recordings and generated speech text go to SenseAudio; and clean up temporary audio files after playback.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:11- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill can send messages on the user's behalf based on speech interpretation, but there is no warning or confirmation requirement before communications are sent. Misrecognition or ambiguous intent could cause unauthorized messages to family contacts, creating privacy, social, or safety consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description advertises notifying children when the user is inactive, but provides no privacy notice, consent flow, or explanation of what information will be shared. For an elderly-focused assistant, silent escalation of behavioral data to family members can undermine privacy expectations and user autonomy.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The ASR API uploads raw voice recordings to an external service, which can contain highly sensitive personal, health, and family information. Because this assistant is designed for elderly users and supports message sending and care workflows, the transmitted audio may reveal especially private data and should be treated as sensitive.
- Content
语音识别（ASR）
bash curl https://api.senseaudio.cn/v1/audio/transcriptions \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -F file="@recording.wav" \ -F model="sense-asr" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The ASR API uploads raw voice recordings to an external service, which can contain highly sensitive personal, health, and family information. Because this assistant is designed for elderly users and supports message sending and care workflows, the transmitted audio may reveal especially private data and should be treated as sensitive.
- Content
语音识别（ASR）
bash curl https://api.senseaudio.cn/v1/audio/transcriptions \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -F file="@recording.wav" \ -F model="sense-asr" \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The ASR example hard-codes
language="zh", and the rest of the skill content and prompts assume Chinese-only interaction. This is a language-policy concern because the skill enforces a specific language/locale without documenting opt-in or offering a choice.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
语音合成（TTS）— 适老化参数
bash curl -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
语音合成（TTS）— 适老化参数
bash curl -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
语音合成（TTS）— 适老化参数
bash curl -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The code sends
language: zhto ASR, and other requests also uselang=zh, making Chinese the mandatory language behavior. The file does not present this as a user-selected or region-justified constraint, so it constitutes a natural-language locale policy issue.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest describes a phone-based elderly voice assistant, but the implementation invokes host binaries ('afplay', 'play', 'mpg123') via subprocess to play audio. Executing local programs is a broader host-control capability than the stated assistant purpose requires and is especially unjustified when the manifest does not mention shelling out or local binary execution.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The TTS function transmits synthesized response text to an external provider, and those responses may contain sensitive content such as private messages, reminders, health-related prompts, or conversational data. In this skill's elderly-care context, externalizing potentially sensitive personal data without minimization or explicit disclosure increases privacy risk.
- Content
md def tts_speak(text: str) -> None: """TTS 合成并播放，适老化参数""" payload = {**ELDERLY_TTS_PARAMS, "text": text} resp = requests.post( TTS_URL, headers={"Authorization": f"Bearer {API_KEY}", "Content-Type": "application/json"}, json=payload,
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The scheduler performs inactivity monitoring and can notify family members without any visible consent, authorization model, or confirmation from the elderly user. This creates a privacy and autonomy risk because usage metadata and inferred welfare status are disclosed proactively to third parties, which is especially sensitive in a caregiving context.
- Content