WhatsApp语音消息免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill is mostly aligned with WhatsApp text-to-speech sending, but its outbound messaging behavior is under-scoped and mixed with broad or inconsistent invocation guidance.

Install only if you want an agent to generate and send WhatsApp voice messages. Confirm the exact recipient and audio content before each send, prefer the documented --no-send mode for previews, avoid storing default phone numbers in shared config, and pin or verify TTS packages and voice models before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:177

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:177 and SKILL.md:341
Vulnerability Type: Unpinned Python dependency
Risk Level: Medium

Vulnerable Code

bash

# Install Piper TTS
pip3 install --user piper-tts

The dependency table repeats the same installation pattern:

text

| piper-tts | Python library | Required | `pip install piper-tts` |

Technical Analysis

The Skill instructs an agent or user to install piper-tts without specifying an audited version or verifying a package hash. Package resolution therefore depends on mutable package-index state at installation time.

If the package distribution, publisher account, or configured package index is compromised, a later installation could retrieve content different from what was reviewed. Installation may execute package build or installation logic with the privileges of the invoking user. The --user option avoids a system-wide installation but does not isolate the package from the user's Python environment or protect files and credentials accessible to that account.

The available evidence does not establish that piper-tts is malicious. The vulnerability is the absence of version and integrity controls around executable third-party content.

Attack Path

1. An attacker compromises the dependency publisher, package distribution channel, or package index used by the environment.
2. The attacker publishes a modified release under the dependency name.
3. A user or agent follows the Skill and runs the unpinned installation command.
4. The package manager resolves the attacker-controlled release because no exact version or hash is required.
5. Malicious build, installation, import-time, or runtime behavior executes in the context of the invoking user.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip. This could expose or modify files, environment variables, agent-accessible data, generated audi ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically audited version, such as piper-tts==X.Y.Z.
• Generate and enforce SHA-256 hashes using a lock file or pip install --require-hashes.
• Record the trusted package index explicitly and require TLS certificate validation.
• Install the package in a dedicated virtual environment rather than the user's shared Python environment.
• Review transitive dependencies and lock their versions and hashes as well.
• Use a controlled internal package mirror where practical.
• Add an update process that reviews new releases before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:190

Finding

Voice Model Downloads Lack Immutable Source and Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:190-198 and SKILL.md:327-329
Vulnerability Type: Unverified external model dependency
Risk Level: Medium

Vulnerable Code

bash

### 2. Download voice models

# Create the model directory
mkdir -p ~/.tts-whatsapp/models/
# ...
# Download a Chinese voice model
# Download the .onnx and .onnx.json files from the Piper voice repository
# Place them in ~/.tts-whatsapp/models/

The FAQ provides only a broad hosting reference:

text

### Q6: Where can voice models be downloaded?

Download `.onnx` and `.onnx.json` files from the Piper voice repository
(Hugging Face), then place them in the configured model directory.

Technical Analysis

The instructions do not identify a canonical repository URL, trusted publisher identity, immutable commit or release revision, exact filenames, signatures, or expected cryptographic hashes. An agent must therefore discover and select the source independently, creating opportunities for repository impersonation, typosquatting, compromised mutable files, or accidental retrieval from an untrusted fork.

The model and associated configuration are consumed by the local TTS stack. At minimum, substituted artifacts can alter, corrupt, or manipulate synthesized audio. Depending on vulnerabilities in the ONNX parser, runtime, or configuration handling, a crafted artifact might also target the model-processing software. The audit did not establish such a parser vulnerability or identify a malicious model; that possibility is conditional rather than confirmed.

Attack Path

1. An attacker publishes an impersonating Piper model repository or compromises a mutable upstream repository.
2. A user or agent searches for the broadly described repository because the Skill supplies no canonical immutable reference.
3. The attacker-controlled .onnx or .onnx.json files are downloaded into ~/.tts-whatsapp/models/.
4. The local TTS process loads the substituted arti ...[truncated 804 chars]

Remediation

View remediation

Remediation Suggestions

• Provide the exact canonical HTTPS repository and verified publisher identity.
• Pin every model to an immutable release tag or commit digest.
• Specify exact .onnx and .onnx.json filenames.
• Publish expected SHA-256 checksums and require verification before model loading.
• Prefer signed release manifests and verify signatures against a documented trusted key.
• Reject models whose filename, revision, hash, or signature differs from the approved manifest.
• Avoid automated repository discovery or downloads from search results and untrusted forks.
• Run model processing with minimal privileges and without access to unrelated credentials or sensitive files.
• Document a controlled process for reviewing and approving model updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill prominently describes automatic WhatsApp sending and file cleanup without an upfront safety notice about external messaging, possible charges, privacy exposure, and local file deletion. In an autonomous-agent context, users and orchestrators may not realize the skill can perform real-world actions affecting contacts and the local system.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The feature matrix states '群组发送 | 不支持' for the free version, but later the command-line parameter description says '--target NUMBER WhatsApp 手机号或群组 ID'. That is an active contradiction in the skill's own documentation about whether group targets are supported.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The scope keyword list is excessively broad and vague, making it easier for an orchestrator to match this skill in contexts where the user did not intend message sending. Because the skill advertises automatic sending and has execution capability, overbroad routing raises the risk of unintended external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are overly broad and inconsistent with the skill's real purpose, which increases the chance an agent invokes a tool capable of sending WhatsApp messages for unrelated requests. In an agentic environment with exec and write capability, mistaken invocation can lead to unintended outbound communication or side effects on user data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

brew install ffmpeg
# ...
# Ubuntu / Debian
sudo apt install ffmpeg
# ...
# Windows (scoop)
scoop install ffmpeg

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

bash

# 创建模型目录
mkdir -p ~/.tts-whatsapp/models/
# ...
# 下载中文语音模型
# 从 Piper 语音仓库下载 .onnx 和 .onnx.json 文件

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is documented throughout as a WhatsApp text-to-speech voice message sender, but the trigger condition says it should be used when '需要文本翻译、多语言转换、本地化处理时使用'. Translation/localization is a different capability than synthesizing and sending audio messages, so this guidance misstates the skill's actual intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.