Mambo TTS

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This appears to be a normal text-to-speech skill, with a privacy caveat that text may be sent to Microsoft Edge TTS.

Install only if you are comfortable sending the text you convert to speech to Microsoft Edge TTS. Avoid submitting secrets, private personal data, regulated content, or confidential business material unless that provider use is acceptable to you.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states the skill uses Microsoft Edge TTS but does not clearly warn that user-provided text is transmitted to an external Microsoft service. This creates a real privacy and data-handling risk because users may submit sensitive content under the assumption processing is local, especially in an agent/skill ecosystem where trust boundaries are not obvious.

VirusTotal

66/66 vendors flagged this skill as clean.