ClawHub
Back to skill

Security audit

Voice Clone

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SenseAudio voice-cloning and TTS helper, with expected use of the SenseAudio API and no hidden persistence or unrelated behavior found.

Install only if you intend to send selected text, voice_id values, and your SenseAudio API credential to SenseAudio for TTS. Consider pinning dependency versions or using a locked environment, and keep SENSEAUDIO_API_KEY scoped to this service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14-18
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

yaml
    install:
      - kind: uv
        package: requests
      - kind: uv
        package: pydub

Technical Analysis

The Skill installs requests and pydub without fixed versions, lockfile constraints, or integrity hashes. Consequently, installation can resolve package versions published after this audit. A compromised package release, package registry account, distribution artifact, or dependency in the transitive dependency graph could introduce unauthorized code.

Python source distributions may execute build-related code during installation, while malicious package code can also execute when imported by the documented helpers. This is particularly sensitive because the Skill imports requests in the same process that reads SENSEAUDIO_API_KEY. The optional pydub package also processes user-supplied audio files and should not be installed when local validation is unnecessary.

The documented HTTPS requests to https://api.senseaudio.cn/v1/t2a_v2 are necessary for the declared TTS functionality and are not hidden exfiltration. The concern is that an untrusted future dependency version could alter that expected behavior.

Attack Path

  1. An attacker compromises a dependency publisher, package registry, release artifact, or relevant transitive dependency.
  2. The attacker publishes a malicious version that remains compatible with the unconstrained package name.
  3. A user installs or initializes the Skill after that version becomes available.
  4. The package manager resolves and installs the malicious release because no reviewed version or hash is specified.
  5. Malicious code executes during package build, installation, import, or use.
  6. The code accesses resources available to the Agent process, potentially including SENSEAUDIO_API_KEY, user-pro ...[truncated 664 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each dependency to a reviewed exact version rather than resolving the latest available release.
  2. Use a committed lockfile with cryptographic hashes for all direct and transitive dependencies.
  3. Configure installation to require hash verification and fail when an artifact does not match the approved lockfile.
  4. Install packages only from an explicitly trusted registry and disable unneeded alternate indexes.
  5. Do not install pydub unless the user requests local audio validation.
  6. Run dependency installation and audio processing with minimal filesystem, environment, and network privileges.
  7. Keep SENSEAUDIO_API_KEY unavailable during dependency installation where operationally possible.
  8. Regularly scan the locked dependency set for known vulnerabilities and review updates before changing pinned versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
import requests

API_KEY = os.environ["SENSEAUDIO_API_KEY"]
API_URL = "https://api.senseaudio.cn/v1/t2a_v2"


def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):
    response = requests.post(
        API_URL,
        headers={
            "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md
def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):
    response = requests.post(
        API_URL,
        headers={
            "Authorization": f"Bearer {API_KEY}",

Static analysis

No suspicious patterns detected.