ClawHub
Back to skill

Security audit

HeyGen TTS免费版

Security checks for vulnerabilities and agentic risk

Overview

This skill is a HeyGen cloud text-to-speech guide with expected API and file output behavior, but its wording is broad and users should avoid sending sensitive text.

Install only if you intend to use HeyGen's cloud TTS service. Treat any text you synthesize as being sent to HeyGen, protect the HEYGEN_API_KEY, review commands before running them, and prefer pinned dependencies or an isolated environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:345
Finding

Unpinned Third-Party Python Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 345
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Code Snippet:

markdown
| requests | Python library | Recommended (Python) | `pip install requests` |

Technical Analysis

The Skill recommends installing the requests package without specifying an exact version, package hash, or trusted package index. Consequently, the installed artifact depends on the package registry and dependency resolution state at execution time.

The package name is legitimate and there is no evidence that the Skill intentionally references a malicious package. Nevertheless, an unpinned installation is not reproducible and could retrieve a compromised release, an unexpectedly incompatible future release, or content from an untrusted package index configured in the execution environment.

Because package installation and imported package code run with the invoking user's permissions, compromise of the resolved package or one of its dependencies could affect the Agent's local execution environment.

Attack Path

  1. An Agent or user follows the dependency setup instruction in SKILL.md.
  2. The command resolves the latest compatible package through the environment's configured Python package index.
  3. An attacker compromises an upstream release, a transitive dependency, or the configured package index.
  4. The package manager downloads and installs the attacker-controlled artifact because no version or hash constraint rejects it.
  5. Malicious code executes during package installation or when the Skill's Python examples import and use the package.

This exploitation path requires a compromised dependency source, release, transitive dependency, or local package-index configuration; none of those conditions were observed directly in the audited project.

Impact Assessment

If the dependency supply chain were compromised, malicio ...[truncated 554 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and all transitive dependencies to reviewed versions in a lock file or requirements file.

  2. Record cryptographic hashes for every approved distribution and install with hash enforcement:

    bash
    python -m pip install --require-hashes -r requirements.txt

  3. Configure an explicitly trusted package index rather than relying on ambient package-manager configuration.

  4. Generate and review the dependency lock file through a controlled build process, and update it through regular vulnerability-review procedures.

  5. Run dependency installation and the TTS workflow in an isolated, least-privileged virtual environment or container.

  6. Update the documentation to reference the reviewed requirements file instead of directly recommending pip install requests.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Vague Triggers

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill's trigger/scope text is overly broad and includes many generic terms, making it more likely to activate for unrelated user requests. In an agent environment, overbroad routing can cause unintended external API use, unnecessary handling of user content, and misuse of the skill's read/write/exec capabilities in contexts the user did not intend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description says this is a HeyGen text-to-speech tool, but L015 explicitly says it should be used for text translation, multilingual conversion, and localization. The rest of the file documents only voice listing, speech synthesis, and audio download; no translation capability is implemented, so the stated behavior does not match the actual operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill declares broad exec capability even though its documented purpose is basic TTS generation via an external API. Excess execution privileges violate least privilege and can let the agent run arbitrary shell commands if later prompted or if the skill is composed with untrusted input, increasing the attack surface beyond what TTS requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation does not clearly warn that user-provided text is transmitted to HeyGen and that resulting audio is later fetched from external URLs. This omission creates a data-handling transparency issue: users may unknowingly send sensitive text to a third party or cause the agent to retrieve remote content without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

为视频生成中文旁白.

bash
# 查询中文语音
curl -X GET "https://api.heygen.com/v3/voices?engine=starfish&language=Chinese" \
  -H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

为视频生成中文旁白.

bash
# 查询中文语音
curl -X GET "https://api.heygen.com/v3/voices?engine=starfish&language=Chinese" \
  -H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

为视频生成中文旁白.

bash
# 查询中文语音
curl -X GET "https://api.heygen.com/v3/voices?engine=starfish&language=Chinese" \
  -H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

为视频生成中文旁白.

bash
# 查询中文语音
curl -X GET "https://api.heygen.com/v3/voices?engine=starfish&language=Chinese" \
  -H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

为视频生成中文旁白.

bash
# 查询中文语音
curl -X GET "https://api.heygen.com/v3/voices?engine=starfish&language=Chinese" \
  -H "X-Api-Key: $HEYGEN_API_KEY"
# ...
# 生成中文语音

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
# ...
def generate_speech(text, voice_id, language="en", speed=1.0):
    """生成语音"""
    response = requests.post(
        "https://api.heygen.com/v3/voices/speech",
        headers={
            "X-Api-Key": os.environ["HEYGEN_API_KEY"],

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
# ...
def generate_speech(text, voice_id, language="en", speed=1.0):
    """生成语音"""
    response = requests.post(
        "https://api.heygen.com/v3/voices/speech",
        headers={
            "X-Api-Key": os.environ["HEYGEN_API_KEY"],

Static analysis

No suspicious patterns detected.