ClawHub
Back to skill

Security audit

Pocket Tts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local text-to-speech wrapper with some install and documentation cautions, but no artifact-backed malicious or hidden behavior.

Install in an isolated Python environment, pin or review package versions before use, expect initial network access for package/model/voice downloads, and use voice cloning only for voices you have permission to reproduce.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
install.sh:5
Finding

Unpinned Third-Party Dependencies Are Installed and Executed

Content
View full analysis

Vulnerability Details

File Location: install.sh:5; SKILL.md:22-25
Vulnerability Type: Unpinned third-party dependency installation and immediate package execution
Risk Level: Medium

Vulnerable Code

install.sh:5:

bash
pip install torch scipy huggingface_hub

SKILL.md:22-25:

bash
pip install pocket-tts

# Or use uv for automatic dependency management
uvx pocket-tts generate "Hello world"

Technical Analysis

The installation script and documentation retrieve third-party Python packages without fixed versions, cryptographic hashes, or a reviewed lockfile. Consequently, the exact code installed can change between executions. The uvx instruction is particularly sensitive because it retrieves and immediately executes the resolved package.

Python package installation can execute package-controlled build logic, while invoking an installed package executes its runtime code. If a referenced package, one of its transitive dependencies, or the configured package index is compromised, attacker-controlled code could run without any modification to this repository.

This finding does not establish that the currently named packages are malicious. It identifies a supply-chain weakness that makes installation behavior dependent on mutable external package releases.

Attack Path

  1. An attacker compromises a referenced package, a transitive dependency, or the package distribution account/index used by the victim.
  2. The attacker publishes a malicious release that remains compatible with the unconstrained dependency specification.
  3. A user follows SKILL.md or runs install.sh.
  4. pip or uvx resolves and downloads the malicious release.
  5. Attacker-controlled code executes during package installation, import, or command invocation.
  6. The malicious code operates with the permissions and environmental access of the invoking user.

Impact Assessment

Successful exp ...[truncated 531 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version rather than allowing unconstrained resolution.
  2. Generate and commit a lockfile that records all transitive dependencies.
  3. Require cryptographic hashes for downloaded artifacts, such as through a hash-locked requirements file and pip --require-hashes.
  4. Replace direct uvx pocket-tts execution with installation of a reviewed, pinned release followed by explicit execution from an isolated environment.
  5. Install dependencies inside a dedicated virtual environment rather than the user's global Python environment.
  6. Use a trusted package index and, where feasible, an internal mirror containing approved artifacts.
  7. Add automated dependency scanning and release-review procedures before updating pins.
  8. Ensure pocket-tts itself is explicitly included in the reviewed dependency manifest, because the current installation script installs supporting libraries but not the package required by cli.py.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · cli.py (reported line 100)May include surrounding context.

python
if args.serve:
        print("🚀 Starting Pocket TTS server on http://localhost:8000")
        os.system("pocket-tts serve")
        sys.exit(0)
    
    if not args.text:

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill claims it is fully local and makes no API calls or internet connections, but later notes that the first run downloads the model and the sample code references Hugging Face-hosted assets. This mismatch can mislead users operating in restricted, privacy-sensitive, or air-gapped environments into enabling network access or exposing usage patterns and model fetches unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation promotes voice cloning from an arbitrary WAV sample without warning about consent, impersonation, or privacy risks. In this context, the capability meaningfully increases the likelihood of misuse for social engineering, fraud, or unauthorized replication of a person's voice, especially because the skill presents it as a simple built-in feature.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation example uses uvx pocket-tts without pinning a specific version, which can cause users to fetch and execute whatever package version is current at runtime. In a supply-chain compromise or malicious update scenario, this increases the risk of unreviewed code execution on the user's machine.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The module docstring presents the program as a local text-to-speech CLI that converts input text to audio files. However, the code also exposes a --serve mode and executes os.system("pocket-tts serve"), which is a materially different operational mode and contradicts the 'local text-to-speech' CLI-only framing in the documentation.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · test.sh (reported line 23)May include surrounding context.

sh
echo ""
echo "📋 Skill files created:"
ls -la /home/clawdbot/clawd/skills/pocket-tts/

echo ""
echo "💡 Usage:"

Static analysis

No suspicious patterns detected.