Security audit

Valtec Vietnamese TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill appears intended for local Vietnamese text-to-speech, but installing it runs and later executes code from an unpinned external repository that was not part of the reviewed artifact.

Review before installing. Only install this if you trust the upstream valtec-tts repository and are comfortable running Python code from its current default branch; prefer pinning a reviewed commit. Use voice cloning only with audio you are authorized to use, and avoid deceptive impersonation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Third-Party Repository Is Installed and Executed## Vulnerability Details **File Location**: `SKILL.md:14-18` and `SKILL.md:43-47`; execution path in `bin/valtec-tts.js:77-99` **Vulnerability Type**: Unpinned executable dependency and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code ```json5 "install": [ { "id": "clone-repo", "kind": "shell", "cmd": "git clone https://github.com/tronghieuit/valtec-tts.git ~/.openclaw/tools/valtec-tts && cd ~/.openclaw/tools/valtec-tts && pip install -e .", "label": "Clone repo and install dependencies", }, ], ``` The same installation procedure is documented for users: ```bash git clone https://github.com/tronghieuit/valtec-tts.git ~/.openclaw/tools/valtec-tts cd ~/.openclaw/tools/valtec-tts pip install -e . ``` The wrapper later executes Python scripts from that checkout: ```javascript if (zeroshot) { if (!reference) usage("--reference is required for --zeroshot mode."); script = path.join(ttsDir, "infer_zeroshot.py"); if (!fs.existsSync(script)) usage(`Script not found: ${script}`); scriptArgs = [ script, "-t", text, "-r", reference, "-o", outputPath, "--speed", speed, ]; } else { script = path.join(ttsDir, "infer.py"); if (!fs.existsSync(script)) usage(`Script not found: ${script}`); scriptArgs = [ script, "-t", text, "-o", outputPath, "-s", speaker, "--length_scale", speed, ]; } ``` ### Technical Analysis The installation command clones the current default branch of an external GitHub repository without pinning a reviewed commit or immutable release. It performs no checksum, signature, or provenance verification before running `pip install -e .`. Python package installation can execute repository-controlled build or installation logic. In addition, the local wrapper explicitly invokes `infer.py` or `infer_zeroshot.py` from the mutable checkout. Consequ ...[truncated 1641 chars]
Remediation: ## Remediation Suggestions 1. Pin the repository to a specific, reviewed commit hash or immutable signed release rather than cloning the moving default branch. 2. Download a versioned release artifact and verify a maintainer-published cryptographic checksum or signature before installation. 3. Use a Python lock file with exact versions and hashes, and install dependencies with hash verification where supported. 4. Avoid editable installation (`pip install -e .`) for production deployment; build and install a reviewed, immutable package artifact instead. 5. Validate the provenance and integrity of model files downloaded at first run. 6. Execute inference in a least-privilege environment with restricted filesystem and network access. 7. Review and pin the upstream inference scripts together with the Skill release so the code executed at runtime matches the audited version.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill requests environment-based capability via `VALTEC_TTS_DIR` and includes shell-based installation steps, but it does not declare an explicit tool scope such as `permissions` or `allowed-tools`. This weakens least-privilege controls and can cause the hosting agent to expose broader execution or environment access than users expect.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly supports zero-shot voice cloning from a short reference clip but provides no warning about consent, impersonation risk, or lawful use of third-party audio. In context, this omission makes misuse easier by normalizing cloning without safeguards, which can enable fraud, harassment, or deceptive impersonation.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The description specifies Vietnamese text-to-speech and the document consistently frames the skill as Vietnamese-only. Because the policy asks to flag language or locale constraints that are forced without user opt-in unless clearly justified as region-specific, this is a natural-language locale restriction.