ClawHub
Back to skill

Security audit

Piper Tts Engine

Security checks across malware telemetry and agentic risk

Overview

The skill is for local text-to-speech, but its API deployment and custom voice examples need review before use because they under-scope access control and sensitive voice-data handling.

Install only if you are comfortable reviewing and tightening the examples before use. Keep any API bound to localhost unless you add authentication, TLS, authorization, request limits, and logging. Use only voice recordings you have permission to process, store them securely, and define deletion/retention rules. Treat the ffmpeg and subprocess snippets as illustrative, not production-ready.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill’s security section says API access should be restricted, but the FastAPI example exposes POST and GET endpoints with no authentication or authorization checks. If deployed as documented, any reachable client could submit synthesis jobs and enumerate or retrieve outputs, creating unauthorized use and possible data exposure.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The documentation claims command execution should avoid user-input command construction, yet the API example passes user-controlled values like req.voice, req.text, req.ssml, req.speed, and req.pitch directly into an executed command. Although subprocess is invoked without a shell, this still allows argument injection into the downstream TTS binary and may enable misuse of file paths, resource exhaustion, or unsafe parser behavior in the called program.

Missing User Warnings

High
Confidence
88% confidence
Finding
The custom voice training section encourages use of user-provided recordings without a clear warning that voiceprints can be sensitive biometric data and may require explicit consent, retention limits, and legal compliance. In this context, the omission is significant because the skill is specifically designed to process and train on personal voice data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The API deployment section instructs users to expose an HTTP service, including a 0.0.0.0 bind example, without an immediate warning about network exposure, authentication, TLS, and abuse risks. This makes unsafe deployment more likely, especially because the service launches background command execution from remote requests.

Unvalidated Output Injection

High
Category
Output Handling
Content
f.write(f"file '{r['file']}'\n")
# ...
full_output = os.path.join(output_dir, "full_audiobook.mp3")
subprocess.run([
    "ffmpeg", "-f", "concat", "-safe", "0",
    "-i", concat_file, "-c", "copy", full_output
], check=True)
Confidence
93% confidence
Finding
subprocess.run([ "ffmpeg", "-f", "concat", "-safe", "0", "-i", concat_file, "-c", "copy", full_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.