T09 · Insecure Skill Coding Practices
Error
- Location
scripts/tts.py:18- Finding
Hard-Coded MiniMax API Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
minimax-tts-send
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible MiniMax text-to-speech tool, but it ships a hard-coded MiniMax API credential and gives broad outbound messaging instructions without enough user control or disclosure.
Review carefully before installing. Do not use this package as published unless the embedded MiniMax API key is removed and rotated, credentials are supplied by each user through a protected secret source, and the skill clearly warns before sending text or generated audio to MiniMax or messaging platforms.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The documented behavior does not match the implemented behavior, and the mismatch includes a reported hardcoded credential/API key. Hidden sensitive behavior and undocumented credentials are dangerous because they can leak secrets, mislead reviewers about what the skill actually does, and enable unauthorized API use or account compromise.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill documentation exposes capabilities involving shell execution and outbound network access, but it declares no tool scope or permission boundaries. In an agent environment, this weakens least-privilege controls and can allow the skill to invoke commands or external APIs without explicit review, increasing the blast radius if the skill is misused or later modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users how to send generated audio to external messaging channels but does not warn about outbound transmission, recipient targeting risks, or privacy implications. This is dangerous because synthesized content may contain sensitive user text, and sending it externally can cause unintended disclosure or abuse, especially in an automation context.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python data = {"voice_type": "all"} try: resp = requests.post(url, headers=headers, json=data, timeout=30) resp.raise_for_status() result = resp.json()
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The function sends user-provided text directly to a third-party TTS service, which can disclose sensitive or private content to an external provider. In a skill context, users may assume text is processed locally unless the network transmission is clearly disclosed, making this a real privacy and data-handling issue.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
This POST transmits arbitrary user text to a remote service for synthesis, which can expose confidential prompts, personal data, or proprietary material to a third party. The skill context increases the risk because text-to-speech content is often natural-language user input that may contain sensitive information, and the script gives no meaningful disclosure or consent mechanism.
- Content
python try: print(f"正在生成语音...", file=sys.stderr) resp = requests.post(url, headers=headers, json=data, timeout=60) resp.raise_for_status() result = resp.json()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The description explicitly positions the skill for generating Chinese speech, which is a locale/language constraint expressed in natural language. The file does not indicate user opt-in for this language restriction or explain that the skill is intentionally region- or language-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The docstring, help text, status messages, and examples are presented only in Chinese. Per the policy, forcing a specific language without offering a user choice can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This function saves audio output to disk, either at a default path or a user-specified path. While it reports the save location afterward, there is no upfront disclosure that the tool performs file writes, which is relevant safety information for command-line skills.
- Content