Edge Tts Cantonese

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it relies on unreviewed local scripts and includes a real-looking Telegram recipient example that could send private voice content to the wrong place.

Review carefully before installing. Only use this skill if you trust and can inspect the referenced local scripts, replace the Telegram chat ID with an intended recipient, and avoid sending sensitive text because the workflow may transmit content to Edge TTS and Telegram.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:27
• Finding: Execution of Unbundled and Unverifiable External Scripts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-36 and 50 **Vulnerability Type**: External local tool trust-boundary violation **Risk Level**: High ### Vulnerable Code ```bash # 只生成 OGG（適合 WhatsApp voice note） /home/gabriel/.openclaw/workspace/scripts/edge-tts-voice-ogg.sh "你今日好嗎？" normal # Slow/sad tone /home/gabriel/.openclaw/workspace/scripts/edge-tts-voice-ogg.sh "我好傷心..." slow # Fast/happy tone /home/gabriel/.openclaw/workspace/scripts/edge-tts-voice-ogg.sh "好開心呀！" fast # Angry/impatient tone /home/gabriel/.openclaw/workspace/scripts/edge-tts-voice-ogg.sh "你到底聽唔聽我講？" angry ``` ```bash /home/gabriel/.openclaw/workspace/scripts/edge-tts-telegram.sh <chat_id> "你段文字" normal ``` ### Technical Analysis The skill delegates its substantive behavior to shell scripts at absolute paths outside the audited project. Neither script is included in the package, so their implementation, argument handling, network destinations, filesystem operations, and other side effects cannot be reviewed. The referenced files can be created or replaced independently after this skill has been audited. Consequently, a legitimate-looking voice-generation request may execute arbitrary logic controlled by whoever can modify the external script path. The use of an absolute, user-specific path also makes the skill non-portable and prevents it from establishing that the invoked executable belongs to the reviewed package. This is classified as tool hijacking because the trusted skill instruction invokes mutable external tools whose identity and integrity are not established. ### Attack Path 1. An attacker obtains write access to `/home/gabriel/.openclaw/workspace/scripts/`, or compromises the deployment process responsible for those scripts. 2. The attacker creates or replaces `edge-tts-voice-ogg.sh` or `edge-tts-telegram.sh` with malicious shell code. 3. A user requests a Cantonese voice reply, causing the agent to follow the skill instructions. 4. The agen ...[truncated 810 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Include all required scripts within the audited skill package rather than referring to mutable files outside it. - Resolve executable paths relative to a trusted, immutable skill directory. - Ensure the packaged scripts are subject to the same review and integrity controls as `SKILL.md`. - Verify script integrity before execution using signed artifacts, deployment manifests, or cryptographic hashes. - Restrict write access to the script directory and files. - Execute scripts with the minimum necessary filesystem, network, and credential access. - Validate tone values against an explicit allowlist and pass message text as a safely quoted argument without dynamic shell evaluation. - Document all network services, API endpoints, output files, and side effects. - Refuse execution if the expected script is missing, has unexpected ownership or permissions, or fails integrity verification. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54
• Finding: Hard-Coded Telegram Recipient in an Executable Example<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-56 **Vulnerability Type**: Hard-coded external recipient identifier **Risk Level**: Medium ### Vulnerable Code ```bash /home/gabriel/.openclaw/workspace/scripts/edge-tts-telegram.sh 8474074290 "主人，我係小蝦。" fast ``` ### Technical Analysis The executable example contains a concrete, real-looking Telegram chat identifier rather than an unmistakable placeholder. An agent or operator following the example literally could send generated content to that fixed account. Because the script is explicitly described as a Telegram sending script, the recipient identifier controls the external destination of the message. Embedding a fixed destination in operational documentation creates a data-disclosure risk, particularly when agents reuse examples or substitute only the message text. ### Attack Path 1. A user or agent consults the skill documentation to send a Telegram voice reply. 2. The documented example is copied or executed without replacing the numeric chat identifier. 3. The external Telegram script uses `8474074290` as the destination. 4. The generated message or audio is sent to that fixed Telegram chat instead of the intended recipient. 5. The unintended recipient receives potentially private user-supplied content. ### Impact Assessment Exploitation or accidental activation can disclose generated speech, message text, and associated communication metadata to an unintended Telegram recipient. It may also cause unauthorized outbound communication under the credentials used by the Telegram sending script. The demonstrated scope is limited to content passed to the send operation; the audited file does not establish access to broader Telegram account data or elevated system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace the numeric identifier with an unmistakable placeholder such as `<user_confirmed_chat_id>`. - Require the recipient identifier to come from trusted session context rather than copied documentation. - Display the resolved recipient and obtain explicit user confirmation before transmitting content. - Validate that the identifier belongs to the intended conversation or an approved recipient allowlist. - Separate generation from transmission so users can inspect the output before sending it. - Avoid including real account identifiers, chat identifiers, tokens, or other deployment-specific values in examples. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest description says the skill should trigger on 'voice reply requests,' which is broad enough to activate in contexts the user may not intend. In a skill that generates and sends audio through external services, overbroad triggering can cause unintended processing or transmission of message content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs use of Microsoft Edge TTS but does not warn that provided text may be transmitted to an external service for speech generation. Users may unknowingly send sensitive or private message content off-device, creating a privacy and data-handling risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Telegram send workflow describes sending generated audio and message content to Telegram without any disclosure that data is being transmitted to a third-party messaging service. This is dangerous because users may assume the skill is only performing local conversion, while it can actually exfiltrate conversational content and metadata such as chat IDs.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The skill is hard-coded around Cantonese output and the zh-HK-HiuMaanNeural voice, with no indication that users can choose a different language or locale. This can violate language/locale policy when the skill is invoked for general voice replies rather than explicitly Cantonese-only requests.

Static analysis

No suspicious patterns detected.