Security audit

Mybooks tts

Security checks across malware telemetry and agentic risk

Overview

This MyBooks TTS admin skill is mostly coherent, but it needs Review because it handles credentials, clone-voice data, server-side persistent changes, and unrestricted local audio saves.

Install only if you control the MyBooks admin account and trust the configured server. Provide credentials through session-scoped environment variables, confirm book IDs and API keys before conversion, upload only voice samples you have permission to use, monitor server storage, and save downloaded clone audio only to a scratch/output directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares only a Bash tool but functionally requires environment-stored credentials and makes authenticated network calls to a local MyBooks server and optional third-party TTS endpoints. This mismatch weakens reviewability and least-privilege controls because users may not realize the skill can access secrets and transmit data externally.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation guide includes broad natural-language triggers such as '开始转换' and '连接正常吗', which can cause accidental activation for ordinary conversation. Because this skill performs privileged administrative actions, unintended triggering could start conversions, modify server settings, or manipulate stored voice assets without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The conversion documentation does not clearly warn that starting TTS creates persistent server-side audio artifacts and may resume/skip based on existing WAV files. In an admin-only skill, lack of explicit disclosure increases the chance of unintentional storage growth, overwriting expectations, and processing of sensitive book content into durable outputs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The clone-voice upload workflow lacks a clear privacy and consent warning even though it handles biometric voice samples and sends them to a TTS/voice-cloning pipeline. Voice data is sensitive personal data, and insufficient notice can lead to unauthorized cloning, privacy violations, and regulatory exposure.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tts_clone_audio method writes server-returned binary content to any caller-supplied local path via save_to with no path restrictions, confirmation, or safe-directory enforcement. In an agent skill with admin-only capabilities, this can overwrite arbitrary files accessible to the process, enabling local file clobbering, persistence, or disruption if a malicious or compromised caller provides sensitive paths.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

Code: suspicious.env_credential_access
Location: scripts/mybooks_tts_api.py:115