Agentvibes Skill Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This TTS skill is mostly aligned with voice synthesis, but it asks for command execution while documenting automatic unpinned downloads and contains scope and credential contradictions that users should review before installing.

Install only if you are comfortable allowing the agent to run local commands and potentially download Piper and voice models from HuggingFace. Before use, confirm any downloads and install sources manually, avoid entering API keys unless the publisher clarifies why they are needed, and treat cleanup as deleting generated audio cache files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:197

Finding

Unpinned Automatic Installation and Retrieval of Third-Party Components

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 197 and 221-224; execution capability is declared at line 5
Vulnerability Type: Unverified third-party dependency and model retrieval
Risk Level: Medium

Vulnerable Configuration and Instructions

The following is a faithful English rendering of the relevant source instructions:

yaml

allowed-tools: read exec

text

Q: Is a voice download required on first use?
A: When a voice is first used, the Piper engine automatically downloads it
from HuggingFace. It can then be used offline.

text

| Dependency                | Type         | Required    | Acquisition method            |
| Piper TTS                 | Voice engine | Recommended | Automatically downloaded and installed |
| HuggingFace voice library | Resource     | Piper only  | Automatically downloaded      |

Technical Analysis

The skill grants access to the exec tool and instructs the environment to install Piper TTS and download voice resources automatically. However, it does not identify an exact package registry entry, official repository, immutable version, commit revision, model repository, file checksum, or cryptographic signature.

Referring only to HuggingFace identifies a hosting platform, not a specific immutable and authenticated artifact. The effective dependency content can therefore differ from what was reviewed. If the implementation resolves mutable branches, unspecified packages, or unverified artifacts, an upstream compromise, repository substitution, dependency-confusion event, or compromised release could cause attacker-controlled content to enter the local environment.

The repository contains only SKILL.md; no local implementation demonstrating checksum validation, signature verification, package pinning, or restricted artifact loading is present. Consequently, the finding concerns the unsafe dependency acquisition instructions rather than ...[truncated 1941 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency

   • Specify the exact Piper package name and registry.
   • Pin an exact version or immutable commit hash.
   • Use lockfiles where an implementation is added.

2. Pin voice repositories and revisions

   • Document the exact HuggingFace organization, repository, filename, and immutable revision or commit.
   • Do not resolve mutable branches such as main during normal operation.

3. Verify artifact integrity

   • Publish expected SHA-256 or stronger hashes for every downloaded binary and model.
   • Reject artifacts whose hashes do not match.
   • Verify publisher signatures where supported.

4. Require explicit consent

   • Inform the user before any network request, installation, or execution.
   • Display the source, version, destination, and expected integrity value.
   • Do not describe first-use downloads as fully offline behavior.

5. Separate downloading from execution

   • Download into a restricted staging directory.
   • Validate type, size, path, integrity, and signature before installation or loading.
   • Prevent archive path traversal and symbolic-link attacks during extraction.

6. Apply least privilege

   • Run installers and TTS engines without administrative privileges.
   • Restrict filesystem and network access through sandboxing.
   • Allowlist required hosts and deny arbitrary package sources.

7. Fail securely

   • Abort when a version, repository identity, signature, or checksum cannot be verified.
   • Do not silently fall back to an untrusted mirror or similarly named package.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The entire skill description and operational guidance are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to Chinese-speaking contexts. This can violate language/locale policy when a skill imposes a language without opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition says the skill should be used for API integration, interface docking, webhook configuration, and system connection, which does not match the stated purpose of an offline TTS utility. This ambiguous scope can cause an agent to invoke the skill in broader, more privileged contexts than intended, increasing the chance of inappropriate exec use or user confusion about what actions are safe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is marketed as offline and no-account, but the first use of Piper may automatically download voice assets from HuggingFace. Without a prominent warning, users and agents may unknowingly trigger network access, violating assumptions about offline execution, privacy boundaries, or controlled environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation materially contradicts itself about whether the free, offline skill requires an API key: earlier sections say no key is needed, while the limitation section says '需要API Key'. This can cause unsafe operator decisions, failed deployments, or unnecessary credential handling, especially if users are pushed to enter secrets into a tool that should not need them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The cleanup command deletes cached audio files, but the documentation does not present it as a potentially destructive action. A user or agent could invoke it without understanding that prior outputs will be removed, leading to accidental data loss of generated audio artifacts.

Content

No source excerpt is available for this finding.