ClawHub
Back to skill

Security audit

Agentvibes Voice Skill Free

Security checks for vulnerabilities and agentic risk

Overview

This TTS skill appears documentation-only and not malicious, but it asks for broad command and file authority while giving inconsistent guidance about network access, API keys, downloads, and installation.

Install only if you are comfortable giving the agent broad local file and command capabilities for a TTS workflow. Require confirmation before any Piper installation, HuggingFace model download, network call, API key use, or write outside a designated audio/config/cache directory.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:264
Finding

Automatic Installation of an Unpinned TTS Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:264
Vulnerability Type: Unverified and unpinned automatic dependency installation
Risk Level: High

Vulnerable Snippet

The following is an English rendering of the affected documentation row:

markdown
| provider_unavailable | `piper not installed` | Piper TTS engine is not installed | Automatically trigger installation, or instruct the user to install it manually |

Technical Analysis

The Skill instructs the agent to automatically install Piper when the executable is unavailable. However, it does not define:

  • The exact package or executable to install
  • An official, trusted distribution repository
  • A pinned package version or immutable release
  • Expected cryptographic checksums or signatures
  • A specific installation command
  • A mandatory user-confirmation boundary

Consequently, the component selected at runtime may vary from what was reviewed. Package-name ambiguity, compromised mirrors, dependency confusion, or unsafe installation guidance could cause an unintended package or installer to execute with the agent process's permissions.

This finding is limited to an unsafe instruction in a documentation-only Skill. The audited project does not contain an installer script or embedded malicious payload.

Attack Path

  1. A user invokes the Skill on a system where Piper is unavailable.
  2. The agent follows the documented instruction to trigger automatic installation.
  3. Because the source, package identity, version, and integrity requirements are unspecified, the agent or surrounding platform resolves an external installer or package dynamically.
  4. An attacker controlling the resolved package, repository, mirror, network path, or similarly named package supplies malicious installation content.
  5. The package installation process executes the supplied code with the permissions held by the agent or package manager.

Impact Ass

...[truncated 559 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace automatic installation with an explicit, user-approved installation workflow.
  2. Identify Piper by its official project URL and exact package or release artifact.
  3. Pin an immutable version rather than resolving the latest available release.
  4. Publish expected SHA-256 hashes or require signature verification before installation.
  5. Provide platform-specific commands that avoid ambiguous package names.
  6. Do not invoke a shell with dynamically generated package names or URLs.
  7. Perform installation with the least privileged account and avoid administrative access unless independently justified.
  8. Fail safely when validation cannot be completed, and provide manual installation instructions instead of continuing automatically.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:24
Finding

Overly Broad and Unscoped Agent Tool Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-29
Vulnerability Type: Excessive filesystem and command-execution capabilities
Risk Level: Medium

Vulnerable Snippet

yaml
tools:
  - read
  - exec
  - write
  - glob
  - grep

Technical Analysis

The Skill requests general-purpose command execution, filesystem reading and writing, recursive discovery, and content-search capabilities. No path restrictions, command allowlist, argument validation rules, or execution sandbox boundaries are specified.

Basic TTS operation may require narrowly scoped execution of a Piper binary and access to designated input, output, configuration, and voice-cache locations. General filesystem discovery and unrestricted content searching are broader than that core purpose. The combination of glob, grep, read, write, and exec increases the accessible attack surface if the Skill processes malicious or manipulated input.

The document mentions using whitelisted commands as a security principle, but it does not define or technically enforce such a whitelist. Tool declarations alone do not prove unauthorized access has occurred; the risk arises because the requested authority is broader than the documented task and lacks enforceable scope restrictions.

Attack Path

  1. The Skill is activated with all declared tools available.
  2. A malicious or manipulated request induces the agent to search for files outside the required TTS directories.
  3. The agent uses glob, grep, or read to locate and inspect unrelated files accessible to its operating-system account.
  4. The agent may use write to modify accessible files or exec to invoke commands beyond the Piper TTS workflow.
  5. Any discovered information or modified state can then be used in a broader attack chain.

Exploitation depends on the host agent granting these tools without additional sandboxing or approval controls.

Impact Assessmen

...[truncated 552 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove glob and grep unless they are necessary for a documented TTS operation.
  2. Restrict read and write to dedicated input, output, configuration, and voice-cache directories.
  3. Restrict exec to an allowlist containing the verified Piper executable and explicitly supported arguments.
  4. Invoke commands directly as argument arrays rather than through a shell.
  5. Reject shell metacharacters and prevent interpolation of user-controlled text into executable commands.
  6. Require explicit user approval for installation, network access, writes outside designated output locations, and commands not covered by the allowlist.
  7. Run the Skill under a dedicated, non-administrative account or sandbox.
  8. Replace the generic recommendation to run as administrator with directory ownership and least-privilege permission guidance.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The invocation text includes broad, unrelated triggers such as API integration, webhook configuration, system connection, video processing, and media conversion, despite the skill being framed as a TTS client. Overbroad routing language can cause this skill to be selected for tasks outside its safe domain, increasing the chance of unintended command execution, network use, or file operations under a misleading label.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation presents the skill as free, offline, and requiring no account, yet also instructs users to configure an API key and includes API-auth and network failure flows. This inconsistency can mislead users and orchestrators about trust boundaries, network access, and secret handling, causing unnecessary secret exposure or unexpected outbound access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is described as a narrow single-provider TTS tool, but later sections advertise generic API integration, file processing, and command execution as built-in functionality. This scope inflation weakens least-privilege expectations and may cause an agent to grant or invoke broader capabilities than users intended for a simple TTS skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The input parameter definition describes input as generic data or instructions, without constraining accepted commands or schema. Ambiguous inputs make it easier for an agent or user to pass arbitrary instructions that expand behavior beyond intended TTS operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document says voices are automatically downloaded from HuggingFace on first use, but does not present this as a prominent user warning near the main usage path. In a supposedly offline skill, silent or poorly disclosed downloads create supply-chain and privacy risks because user actions may trigger unexpected external network access and artifact retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill advertises file processing and command execution capabilities, including execution in a sandbox, without explicit safety constraints, allowlists, or impact warnings. In the context of an agent skill, mentioning exec/write capability without strict boundaries increases the risk that users or routing systems treat arbitrary command/file operations as acceptable side effects of a TTS tool.

Content

No source excerpt is available for this finding.