ClawHub
Back to skill

Security audit

Voice Clone

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SenseAudio voice-cloning and TTS helper, with expected use of the SenseAudio API and no hidden persistence or unrelated behavior found.

Install only if you intend to send selected text, voice_id values, and your SenseAudio API credential to SenseAudio for TTS. Consider pinning dependency versions or using a locked environment, and keep SENSEAUDIO_API_KEY scoped to this service.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 14-18 **Vulnerability Type**: Unpinned third-party dependencies **Risk Level**: Medium ```yaml install: - kind: uv package: requests - kind: uv package: pydub ``` ### Technical Analysis The Skill installs `requests` and `pydub` without fixed versions, lockfile constraints, or integrity hashes. Consequently, installation can resolve package versions published after this audit. A compromised package release, package registry account, distribution artifact, or dependency in the transitive dependency graph could introduce unauthorized code. Python source distributions may execute build-related code during installation, while malicious package code can also execute when imported by the documented helpers. This is particularly sensitive because the Skill imports `requests` in the same process that reads `SENSEAUDIO_API_KEY`. The optional `pydub` package also processes user-supplied audio files and should not be installed when local validation is unnecessary. The documented HTTPS requests to `https://api.senseaudio.cn/v1/t2a_v2` are necessary for the declared TTS functionality and are not hidden exfiltration. The concern is that an untrusted future dependency version could alter that expected behavior. ### Attack Path 1. An attacker compromises a dependency publisher, package registry, release artifact, or relevant transitive dependency. 2. The attacker publishes a malicious version that remains compatible with the unconstrained package name. 3. A user installs or initializes the Skill after that version becomes available. 4. The package manager resolves and installs the malicious release because no reviewed version or hash is specified. 5. Malicious code executes during package build, installation, import, or use. 6. The code accesses resources available to the Agent process, potentially including `SENSEAUDIO_API_KEY`, user-pro ...[truncated 664 chars]
Remediation
## Remediation Suggestions 1. Pin each dependency to a reviewed exact version rather than resolving the latest available release. 2. Use a committed lockfile with cryptographic hashes for all direct and transitive dependencies. 3. Configure installation to require hash verification and fail when an artifact does not match the approved lockfile. 4. Install packages only from an explicitly trusted registry and disable unneeded alternate indexes. 5. Do not install `pydub` unless the user requests local audio validation. 6. Run dependency installation and audio processing with minimal filesystem, environment, and network privileges. 7. Keep `SENSEAUDIO_API_KEY` unavailable during dependency installation where operationally possible. 8. Regularly scan the locked dependency set for known vulnerabilities and review updates before changing pinned versions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

API_KEY = os.environ["SENSEAUDIO_API_KEY"]
API_URL = "https://api.senseaudio.cn/v1/t2a_v2"


def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):
    response = requests.post(
        API_URL,
        headers={
            "Authorization": f"Bearer {API_KEY}",
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
def generate_with_cloned_voice(text, voice_id, speed=1.0, vol=1.0, pitch=0):
    response = requests.post(
        API_URL,
        headers={
            "Authorization": f"Bearer {API_KEY}",
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.