ClawHub
Back to skill

Security audit

Language Tutor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward SenseAudio text-to-speech helper that discloses its external API use and does not show hidden or destructive behavior.

Install only if you are comfortable sending the text you convert to audio to SenseAudio and exposing SENSEAUDIO_API_KEY to the process running the helper. For stronger hygiene, run it in a limited environment and pin or review the requests and pydub dependency versions before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

yaml
install:
  - kind: uv
    package: requests
  - kind: uv
    package: pydub

Technical Analysis

The Skill declares the third-party requests and pydub packages without exact versions, lockfile constraints, or integrity hashes. Consequently, package resolution may retrieve mutable future releases rather than versions that were reviewed with the Skill.

This creates a supply-chain and reproducibility weakness. If a dependency release or configured package source is compromised, installation can introduce attacker-controlled package code. The audit found no evidence that these package names are typosquatted or currently malicious; the finding concerns the unsafe absence of version and integrity controls.

Attack Path

  1. An attacker compromises a declared dependency, its maintainer account, or a package source trusted by the runtime.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user installs the Skill dependencies without a lockfile, exact version constraint, or hash verification.
  4. The resolver selects and installs the malicious release.
  5. Attacker-controlled code executes during an applicable installation or runtime path when the package is imported or used.

Impact Assessment

Malicious dependency code could execute with the privileges of the user or agent running the Skill. Depending on the host environment, this could expose local files, lesson content, generated audio, environment variables—including SENSEAUDIO_API_KEY—and other credentials accessible to that process. It could also make unauthorized network requests or modify files writable by the process.

The potential scope is limited by the runtime account, sandboxing, filesystem permissions, environment-variable exposure, and outbound-network restri ...[truncated 113 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin each dependency to an exact, reviewed version rather than allowing unconstrained resolution.
  • Maintain a lockfile generated from a trusted package index and review dependency changes before updating it.
  • Require cryptographic hashes for resolved distributions where the installation system supports hash verification.
  • Restrict resolution to an explicitly configured HTTPS package index and disable untrusted supplemental indexes to reduce dependency-confusion risk.
  • Prefer verified package artifacts and record their provenance.
  • Run installation and TTS processing in a sandboxed, non-privileged environment with access only to required files.
  • Expose SENSEAUDIO_API_KEY only to the process that performs the API request and restrict outbound traffic to the declared SenseAudio endpoint where practical.
  • Add automated dependency scanning and periodically update pins after security review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md
Use the official SenseAudio TTS rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/t2a_v2`
- Model: `SenseAudio-TTS-1.0`
- Max text length: `10000` characters
- `voice_setting.voice_id` is required

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
Use the official SenseAudio TTS rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/t2a_v2`
- Model: `SenseAudio-TTS-1.0`
- Max text length: `10000` characters
- `voice_setting.voice_id` is required

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
"channel": 2,
        },
    }
    response = requests.post(
        API_URL,
        headers={
            "Authorization": f"Bearer {API_KEY}",

Static analysis

No suspicious patterns detected.