ClawHub
Back to skill

Security audit

Mambo TTS

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a normal text-to-speech skill, with a privacy caveat that text may be sent to Microsoft Edge TTS.

Install only if you are comfortable sending the text you convert to speech to Microsoft Edge TTS. Avoid submitting secrets, private personal data, regulated content, or confidential business material unless that provider use is acceptable to you.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README states the skill uses Microsoft Edge TTS but does not clearly warn that user-provided text is transmitted to an external Microsoft service. This creates a real privacy and data-handling risk because users may submit sensitive content under the assumption processing is local, especially in an agent/skill ecosystem where trust boundaries are not obvious.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/mambo.js:20

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/xiaoyi.js:20