Valtec Vietnamese TTS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:52 PM UTC
• Version: 1.0.3

Overview

This skill appears intended for local Vietnamese text-to-speech, but installing it runs and later executes code from an unpinned external repository that was not part of the reviewed artifact.

Review before installing. Only install this if you trust the upstream valtec-tts repository and are comfortable running Python code from its current default branch; prefer pinning a reviewed commit. Use voice cloning only with audio you are authorized to use, and avoid deceptive impersonation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Repository Is Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-18 and SKILL.md:43-47; execution path in bin/valtec-tts.js:77-99
Vulnerability Type: Unpinned executable dependency and mutable supply-chain source
Risk Level: Medium

Vulnerable Code

json5

"install":
  [
    {
      "id": "clone-repo",
      "kind": "shell",
      "cmd": "git clone https://github.com/tronghieuit/valtec-tts.git ~/.openclaw/tools/valtec-tts && cd ~/.openclaw/tools/valtec-tts && pip install -e .",
      "label": "Clone repo and install dependencies",
    },
  ],

The same installation procedure is documented for users:

bash

git clone https://github.com/tronghieuit/valtec-tts.git ~/.openclaw/tools/valtec-tts
cd ~/.openclaw/tools/valtec-tts
pip install -e .

The wrapper later executes Python scripts from that checkout:

javascript

if (zeroshot) {
  if (!reference) usage("--reference is required for --zeroshot mode.");
  script = path.join(ttsDir, "infer_zeroshot.py");
  if (!fs.existsSync(script)) usage(`Script not found: ${script}`);

  scriptArgs = [
    script,
    "-t", text,
    "-r", reference,
    "-o", outputPath,
    "--speed", speed,
  ];
} else {
  script = path.join(ttsDir, "infer.py");
  if (!fs.existsSync(script)) usage(`Script not found: ${script}`);

  scriptArgs = [
    script,
    "-t", text,
    "-o", outputPath,
    "-s", speaker,
    "--length_scale", speed,
  ];
}

Technical Analysis

The installation command clones the current default branch of an external GitHub repository without pinning a reviewed commit or immutable release. It performs no checksum, signature, or provenance verification before running pip install -e ..

Python package installation can execute repository-controlled build or installation logic. In addition, the local wrapper explicitly invokes infer.py or infer_zeroshot.py from the mutable checkout. Consequ ...[truncated 1641 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific, reviewed commit hash or immutable signed release rather than cloning the moving default branch.
2. Download a versioned release artifact and verify a maintainer-published cryptographic checksum or signature before installation.
3. Use a Python lock file with exact versions and hashes, and install dependencies with hash verification where supported.
4. Avoid editable installation (pip install -e .) for production deployment; build and install a reviewed, immutable package artifact instead.
5. Validate the provenance and integrity of model files downloaded at first run.
6. Execute inference in a least-privilege environment with restricted filesystem and network access.
7. Review and pin the upstream inference scripts together with the Skill release so the code executed at runtime matches the audited version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill requests environment-based capability via VALTEC_TTS_DIR and includes shell-based installation steps, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can cause the hosting agent to expose broader execution or environment access than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports zero-shot voice cloning from a short reference clip but provides no warning about consent, impersonation risk, or lawful use of third-party audio. In context, this omission makes misuse easier by normalizing cloning without safeguards, which can enable fraud, harassment, or deceptive impersonation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The description specifies Vietnamese text-to-speech and the document consistently frames the skill as Vietnamese-only. Because the policy asks to flag language or locale constraints that are forced without user opt-in unless clearly justified as region-specific, this is a natural-language locale restriction.

Content

No source excerpt is available for this finding.