TTS WhatsApp

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.1

Overview

The skill is meant to send WhatsApp voice messages, but it does not clearly declare or control the command execution, installs, automatic sending, and cleanup it asks an agent to use.

Review this before installing. Use it only if you are comfortable with an agent running local commands, installing dependencies, generating and deleting audio files, and sending message content through WhatsApp/SkillHub. Prefer running with --no-send first, verify the target each time, and avoid sensitive content until the delivery path and retained files are clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 32
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip3 install --user piper-tts

Technical Analysis

The skill instructs users or agents to install piper-tts from the configured Python package index without specifying an exact version, cryptographic hashes, a lockfile, or a verified source repository. Dependency resolution therefore remains mutable: the package version and its transitive dependencies may differ between installations.

Python packages and their build systems may execute code during installation or when imported and invoked. If the selected package release, its distribution infrastructure, or a transitive dependency is compromised, following this instruction could run attacker-controlled code under the installing user's account.

The project contains only SKILL.md; it does not include a vendored or independently reviewable implementation of this dependency.

Attack Path

1. A user or execution-capable agent follows the prerequisite instruction in SKILL.md.
2. The command contacts the environment's configured Python package index and resolves the latest compatible package and transitive dependencies.
3. A compromised, malicious, or unexpectedly changed dependency supplies attacker-controlled installation or runtime code.
4. The code executes during package installation or subsequent TTS use with the privileges of the user running pip3 or the installed command.

This path requires compromise or malicious modification of the resolved dependency or its supply chain; the audited project itself does not contain evidence that the current piper-tts package is malicious.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing user. Within that user's accessible scope, this may expose local files ...[truncated 295 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin piper-tts to a specific, reviewed version rather than allowing unconstrained resolution.
2. Publish a lockfile or requirements file containing cryptographic hashes, and install with hash verification such as pip install --require-hashes -r requirements.txt.
3. Identify the official package index and upstream source explicitly, and document how release provenance is verified.
4. Pin and review transitive dependencies as well as the direct package.
5. Install the dependency in a dedicated virtual environment or other sandbox instead of the user's general Python environment.
6. Add a tested executable implementation to the project or clearly identify the separately maintained tts-whatsapp implementation, including its trusted source and verified version.
7. Re-audit dependencies before updating pinned versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest declares only a read capability, but the documentation describes behavior that would require command execution, file generation/deletion, and outbound message sending. This mismatch can mislead users and enforcement layers about what the skill actually does, increasing the risk of unauthorized side effects or hidden execution paths if an agent follows the prose instead of the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises automatic WhatsApp sending and automatic file cleanup without a prominent warning about data transmission, recipient targeting, or deletion of generated artifacts. In this context, the combination is risky because users may trigger outbound messaging or lose forensic/debugging files without realizing the privacy and operational consequences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill claims no extra API key or external dependency is needed, yet its core function depends on external WhatsApp delivery infrastructure not transparently declared in configuration or dependencies. That omission can cause users to unknowingly transmit data to external services and undermines trust, auditability, and informed consent around where message content is sent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.