Security audit

Pronunciation Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its pronunciation-coaching purpose, but it sends voice recordings to an external API and documents unsafe shell commands that could run unintended commands or upload the wrong local file if inputs are not carefully constrained.

Install only if you are comfortable sending practice text and voice recordings to SenseAudio. Use a constrained runner that serializes JSON safely, passes curl arguments without a shell, validates uploaded recording paths and language codes, and stores progress only after user opt-in in a private app-state location.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:41
Finding: Command Injection Through Unsafely Interpolated TTS Text
Content: View full analysis
\", \"stream\": false, \"voice_setting\": { \"voice_id\": \"\", \"speed\": 0.75 }, \"audio_setting\": { \"format\": \"mp3\" } }" -o slow.json jq -r '.data.audio' slow.json | xxd -r -p > standard_slow.mp3 # Normal version (speed 1.0) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"SenseAudio-TTS-1.0\", \"text\": \"\", \"stream\": false, \"voice_setting\": { \"voice_id\": \"\", \"speed\": 1.0 }, \"audio_setting\": { \"format\": \"mp3\" } }" -o normal.json jq -r '.data.audio' normal.json | xxd -r -p > standard_normal.mp3 ``` ### Technical Analysis The practice text originates from the user and is placed inside a double-quoted shell argument. The instructions do not require JSON-safe serialization or shell-safe handling before replacing ``. A quotation mark in the supplied text can terminate the surrounding shell string. Shell operators, substitutions, or additional commands following that quotation mark may then be interpreted by the command shell. Ordinary text containing quotation marks or backslashes can also produce malformed JSON even when it is not intentionally malicious. The same issue applies to `` if that value ever becomes externally controllable. This vulnerability is present when an agent or runner implements the documented command by directly replacing the placeholders and invokes it through a shell. ## ...[truncated 912 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:82
Finding: Unsafe Recording-Path Interpolation in Shell Command
Content: View full analysis
" \ -F "model=sense-asr-pro" \ -F "response_format=verbose_json" \ -F "language=" \ -F "timestamp_granularities[]=word" \ > asr_result.json ``` ### Technical Analysis The recording path is represented by `` inside a shell command, but the skill does not require the placeholder to be resolved through a trusted upload-object mapping or safely passed as a single argument. If a user-controlled filename or path is inserted literally, a quotation mark can terminate the form argument and introduce shell syntax. In addition, curl's `@path` form syntax instructs curl to read and upload the named local file. If an attacker can influence the resolved path rather than merely the contents of an already validated upload, the command may upload another file readable by the agent. `` is also interpolated into a shell argument and should be restricted to the documented allowlist. ### Attack Path 1. An attacker submits an upload with a malicious filename, or otherwise causes a user-controlled value to be used as ``. 2. The agent directly substitutes that value into the command. 3. For command injection, a quotation breakout causes subsequent shell syntax to be executed. 4. Alternatively, if path selection is not constrained, the attacker supplies a path to another local file. 5. Curl reads that file through `file=@...` and sends it to the external transcription endpoint. The command-injection path depends on literal shell-template substitution. The local-file-upload path depends on the attacker being able to control the resolved path. ### Impact Assess ...[truncated 409 chars]
Remediation: View remediation
&2; exit 1 ;; esac test -f "$recording_path" && test ! -L "$recording_path" || exit 1 curl --fail-with-body --silent --show-error \ -X POST 'https://api.senseaudio.cn/v1/audio/transcriptions' \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ --form "file=@${recording_path}" \ --form-string 'model=sense-asr-pro' \ --form-string 'response_format=verbose_json' \ --form-string "language=${LANGUAGE_CODE}" \ --form-string 'timestamp_granularities[]=word' \ --output "$asr_output" ``` - Restrict `LANGUAGE_CODE` to the documented values: `en`, `zh`, `ja`, `fr`, and `es`. - Obtain user confirmation before sending a recording to an external transcription service. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:50
Finding: Predictable Output Files Permit Symlink-Based File Overwrites
Content: View full analysis
standard_slow.mp3 # Normal version (speed 1.0) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"model\": \"SenseAudio-TTS-1.0\", \"text\": \"\", \"stream\": false, \"voice_setting\": { \"voice_id\": \"\", \"speed\": 1.0 }, \"audio_setting\": { \"format\": \"mp3\" } }" -o normal.json jq -r '.data.audio' normal.json | xxd -r -p > standard_normal.mp3 ``` ```bash > asr_result.json ``` ```markdown Save session results to `pronunciation_progress.json` in the current directory: ```json { "sessions": [ { "date": "", "text": "", "accuracy": 0.6, "errors": ["window (/ow/)", "please (final /z/)"], "phonemes_drilled": ["/ow/", "/z/"] } ] } ``` ``` ### Technical Analysis The skill uses fixed filenames in the current working directory for API responses, generated audio, transcription output, and persistent progress. Shell redirection and curl output handling normally follow existing symbolic links. If another process or workspace participant can create one of these predictable paths before the skill runs, the subsequent write can overwrite the symlink target. Repeated or concurrent sessions can also overwrite each other's files. Directly replacing `pronunciation_progress.json` without locking and atomic replacement can truncate or corrupt progress data if execution is interrupted or sessions write concurrently. The progress file also contains practice history and error information, but no restrictive permissions or retention policy is specified. ### Attack Path 1. An at ...[truncated 1001 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill uploads the user's voice recording to an external transcription API without a clear privacy warning or consent checkpoint. Audio recordings can contain biometric, personal, or incidental sensitive information, so transmitting them off-device without explicit notice meaningfully increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
bash
# Slow version (speed 0.75) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
bash
# Slow version (speed 0.75) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
bash
# Slow version (speed 0.75) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
bash
# Slow version (speed 0.75) curl -s -X POST https://api.senseaudio.cn/v1/t2a_v2 \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -H "Content-Type: application/json" \ -d "{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This endpoint transmits the user's audio recording to an external service, which is significantly more sensitive than plain text because voice data may reveal identity, health, location context, or other incidental personal information. In this skill's context that transmission is functional, but without clear consent and privacy safeguards it is a real privacy vulnerability.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
When the user uploads their recording:

bash
curl -s -X POST https://api.senseaudio.cn/v1/audio/transcriptions \ -H "Authorization: Bearer $SENSEAUDIO_API_KEY" \ -F "file=@<USER_RECORDING>" \ -F "model=sense-asr-pro" \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs saving pronunciation text, accuracy scores, and error history to a local JSON file without informing the user or obtaining consent. This creates a privacy risk because sensitive speech practice content and performance history may persist on disk longer than the user expects and could be accessed by other local processes or users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill description focuses on generating model pronunciation, accepting a recording, giving feedback, and running drills. In addition, the file instructs the agent to save session results and maintain longitudinal progress data in pronunciation_progress.json, which is a stateful storage behavior not mentioned in the manifest description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.