Piper Tts Engine Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a local text-to-speech tool, but it requests local command execution and installation steps that are under-specified, mismatched, and not fully reviewable.

Install only if you are comfortable reviewing or supplying the missing scripts yourself. Run setup only with explicit approval, preferably in a virtual environment or container, pin package and model versions, verify download sources and checksums, and avoid synthesizing sensitive text unless you are comfortable with the resulting audio remaining in ~/.piper/output until deleted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:125

Finding

Unpinned and Unverifiable Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:125-131 and SKILL.md:234-237
Vulnerability Type: Supply-chain risk caused by unpinned third-party dependencies and an unavailable installer
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:125-131:

bash

scripts/setup-piper.sh

The document states that this script installs piper-tts, downloads a default voice model, and configures the output directory. However, the referenced script is not included in the audited project.

SKILL.md:234-237:

text

| piper-tts | Python package | Required | pip install piper-tts (automatically handled by the installation script) |
| Voice model | Model file | Required | The installation script automatically downloads the default voice |
| LLM API | API | Required | Provided by the Agent's built-in LLM |
| onnxruntime | Python package | Required | pip install onnxruntime (automatically installed) |

Technical Analysis

The skill instructs an Agent with exec permission to invoke an installation script that is not present in the project. It also specifies installation of piper-tts and onnxruntime without exact versions, package hashes, a lockfile, or an explicitly trusted package index.

Unpinned package installation resolves whatever package release is available at execution time. Consequently, the effective code installed on a user's system can differ from the dependencies that existed when the skill was reviewed. The missing scripts/setup-piper.sh also prevents auditors from validating the intended package source, model download URL, checksum verification, filesystem changes, and subprocess behavior.

No evidence establishes that the named packages are currently malicious. The vulnerability is the absence of controls that would protect installation against a compromised release, compromised package repository, unsafe replacement installer, or unexpectedly changed dependency.

Attac

...[truncated 1662 chars]

Remediation

View remediation

Remediation Suggestions

1. Include scripts/setup-piper.sh and every referenced runtime script in the project so their behavior can be reviewed.
2. Pin all direct and transitive Python dependencies to exact reviewed versions.
3. Maintain a lockfile or requirements file containing cryptographic hashes, and install with hash enforcement such as pip install --require-hashes.
4. Configure an explicit authenticated package index rather than relying implicitly on the environment's default index.
5. Pin voice-model downloads to documented HTTPS URLs and verify each downloaded artifact against a published SHA-256 or stronger checksum before use.
6. Make installation an explicit, user-approved action instead of automatically installing packages when synthesis is requested.
7. Run installation and synthesis in an isolated virtual environment or restricted container under a non-privileged account.
8. Document all network destinations, files created, directories modified, and subprocesses invoked by the installer.
9. Fail safely if the bundled installer is missing rather than directing the Agent to locate or improvise an external replacement.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Vague and mismatched trigger conditions make the skill eligible for invocation in contexts unrelated to speech synthesis. Because the skill allows exec and includes setup/install commands, accidental triggering can lead to local command execution, dependency installation, or file creation when the user did not intend to use a TTS tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explains that it generates MP3 files locally but does not clearly warn that those files may contain sensitive user-provided text and remain stored on disk. In a local-exec skill, undisclosed persistence can expose private content to other users, backups, indexing tools, or later unintended sharing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The core capabilities state that preset voices are mainly English, and later sections reinforce English-first support, but the skill does not frame this as a user-selectable preference or a clearly justified regional limitation. This can be a language/locale policy concern because the skill effectively defaults users into a specific language context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The technical summary advertises broad CRUD-style operations that are inconsistent with a single-purpose offline speech synthesis skill. Overbroad capability claims can mislead an agent into treating the skill as a generic data-operation interface, enabling unintended actions beyond safe TTS execution paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sections for core execution, configuration, and output handling describe generic import, reset, export, delete, and conversion behaviors unrelated to the stated TTS purpose. Such ambiguous, templated instructions broaden the apparent authority of the skill and may cause unsafe or unintended tool use by the agent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger condition says the skill should be used for generic file processing, document conversion, and content extraction, which does not match a local TTS tool. This can cause the agent to invoke the skill in unrelated contexts and then execute local scripts unnecessarily, increasing the chance of unintended package installs, downloads, or local file handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The quick-start flow tells the agent to run a setup script that installs Python packages and downloads model files, but it does not clearly warn the user beforehand. This weakens informed consent around local system modification and network activity, especially important for a skill with exec permission.

Content

No source excerpt is available for this finding.