Security audit

macOS Local Voice

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent local macOS voice tool, but its text-to-speech helper can overwrite audio files outside its intended output folder when given a custom path.

Review this before installing if you expect agents to handle untrusted instructions or custom output paths. The local voice functionality is purpose-aligned and offline, but the TTS helper should ideally restrict outputs to ~/.openclaw/media/outbound, reject traversal or absolute paths, and avoid overwriting existing files. Until fixed, prefer the default output path and do not let untrusted content choose output_path.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tts.mjs:76
Finding: Unrestricted Output Path Permits Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
able (exit code 0, no error). **Always** use `voices.mjs check` before calling `tts.mjs` with a specific voice name.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/stt.mjs:74

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/tts.mjs:91