ClawHub
Back to skill

Security audit

tts

Security checks for vulnerabilities and agentic risk

Overview

This TTS skill does what it claims, but it sends text to a remote API and can overwrite arbitrary writable files through an unconstrained output path.

Install only if you are comfortable sending the text you convert to the SkillBoss/HeyBossAI service and exposing SKILLBOSS_API_KEY to the script. Use a dedicated output directory with non-sensitive filenames, avoid converting secrets or private data, and prefer a version that constrains output paths and regenerates the lockfile from the current package.json.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_hume_speech.js:47
Finding

Caller-Controlled Output Path Allows Arbitrary File Overwrite

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/package-lock.json:1
Finding

Stale Lockfile Installs an Undeclared and Unused Dependency Tree

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_speech.js:25
Finding

Unbounded and Insufficiently Validated TTS API Responses

Content
View full analysis
Remediation
View remediation
MAX_BASE64_LENGTH) { throw new Error('Invalid or oversized audio response.'); } if (!/^[A-Za-z0-9+/]*={0,2}$/.test(audioBase64)) { throw new Error('Malformed base64 audio response.'); } ``` ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins form-data to 4.0.5, which is flagged as affected by a CRLF injection issue in multipart field names. Even though this file is only a dependency manifest, it directly determines the installed package version, so the vulnerable library would be present at runtime if the code constructs multipart requests with attacker-controlled field names or filenames. In this TTS skill context, the package is pulled transitively through the OpenAI client, which makes exploitability less direct but still plausible if untrusted input is forwarded into multipart form construction.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to an environment secret and implies networked script execution, but it does not restrict tool scope with explicit permissions or allowed-tools. In an agent environment, this increases the chance the skill can invoke broader capabilities than intended, including accessing secrets or making outbound requests beyond the minimal TTS workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description says to use the skill when the user asks for 'an audio message, a voice reply, or to hear something' and includes the natural phrase 'of vive voix'. These triggers are broad conversational expressions without clear boundaries or exclusion conditions, which could cause unintended invocation in ordinary chat contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the full user-provided text to a third-party remote API for speech generation, but there is no explicit disclosure, consent check, or safeguard against submitting sensitive content. In a TTS skill, users may provide private messages, credentials, or personal data, so silent external transmission creates a real privacy and data-handling risk even if the behavior is functionally necessary.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_hume_speech.js (reported line 14)May include surrounding context.

js
const options = program.opts();

const API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function main() {
  if (!API_KEY) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_speech.js (reported line 14)May include surrounding context.

js
const options = program.opts();

const API_KEY = process.env.SKILLBOSS_API_KEY;
const API_BASE = 'https://api.heybossai.com/v1';

async function main() {
  if (!API_KEY) {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency version for commander is specified with a caret range (^11.0.0), which permits automatic installation of newer compatible releases rather than a single audited version. This creates supply-chain risk because a compromised or breaking upstream release could be pulled into the build or deployment environment without explicit review.

Content

Scanner excerpt · scripts/package.json (reported line 7)May include surrounding context.

json
"description": "Helper script for SkillBoss API Hub TTS",
  "main": "generate_speech.js",
  "dependencies": {
    "commander": "^11.0.0"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/generate_hume_speech.js:13

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/generate_speech.js:13