T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:45- Finding
API Credentials Exposed Through Terminal Output
- Content
View full analysis
- Remediation
View remediation
Security audit
智能配音合成虾
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent cloud TTS tool, but its setup guidance can print API keys in plaintext and its external data sharing and unsupported advertised features are under-disclosed.
Review this skill before installing. Do not run the documented API-key echo command; check only whether keys are set, and rotate any key already exposed in logs or transcripts. Use it only for text you are comfortable sending to ElevenLabs or OpenAI, and install dependencies in an isolated environment with pinned versions where possible.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:104- Finding
Unpinned Third-Party Runtime Dependencies
- Content
View full analysis
- Remediation
View remediation
openai== pydub== ``` 3. Generate and enforce hashes using a reproducible dependency-management tool such as `pip-tools`: ```bash pip-compile --generate-hashes requirements.in pip install --require-hashes -r requirements.txt ``` 4. Commit the input manifest and generated lockfile to the repository. 5. Review and test dependency updates before merging them. 6. Enable automated vulnerability and provenance scanning for direct and transitive dependencies. 7. Install packages from explicitly trusted indexes and prevent unintended extra-index resolution. 8. Pin or otherwise document a tested FFmpeg release and verify package signatures or checksums where the distribution mechanism supports them. 9. Perform installation and synthesis in a least-privileged virtual environment or isolated container without unnecessary secrets or filesystem access. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
代码的核心目的与声明大体一致，确实是一个配音/语音合成脚本，并支持多音色、情感、速度和后期处理。但声明中的若干关键能力与实际行为不符，属于重要功能夸大。尤其是 Azure TTS、系统 TTS 降级和 SSML 支持均未实现；代码只尝试 ElevenLabs 与 OpenAI，两者都失败时直接退出。因此应判定为描述与实际行为存在不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs use of shell commands, environment-variable access, and file reads without declaring any explicit tool scope or permission boundaries. That creates unnecessary ambiguity about what the agent may access at runtime and can enable over-privileged execution, especially because secrets like API keys are referenced directly from the environment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Overly broad trigger phrases increase the chance that this skill activates for ordinary conversation or unrelated audio requests, causing unintended shell/file/env-capable behavior to run. In an agent ecosystem, excessive trigger overlap can route benign user input into a higher-privilege workflow than necessary.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The file is written as a normative guide headed entirely in Chinese and presents the processing specification without any indication that language selection is optional or region-specific. Under the policy rule, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example hard-codes
xml:lang="zh-CN", and the document overall is written as a prescriptive guide for SSML usage in Chinese. Because the file does not indicate that this is optional, illustrative, or limited to a region-specific use case, it can be read as enforcing a specific language/locale without user opt-in.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring states that the script supports Azure TTS and will automatically degrade to a system TTS engine. In the actual implementation, only
synthesize_elevenlabsandsynthesize_openaiare called, and if both fail the program exits with an error rather than using Azure or any system TTS fallback.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is an active contradiction between documentation and behavior, not just an omission. The file-level docstring promises Azure and fallback behavior, while the control flow at L206-L214 only tries ElevenLabs and OpenAI and then terminates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script transmits user-provided text to ElevenLabs, an external third-party service, without an explicit warning or consent mechanism. In this skill context, users may submit scripts, narration, or unpublished content, so silent transmission can expose sensitive or proprietary material and create privacy/compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The OpenAI fallback sends the full input text to a third-party API without explicit user-facing disclosure. Because this occurs as a fallback path, users may be even less aware that their content is leaving the local environment, increasing privacy and policy-compliance risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The natural-language instructions and preprocessing rules assume Chinese text handling, including converting numbers to Chinese and annotating Chinese pronunciations, but do not state that the skill is China/Chinese-specific or offer users a language/locale choice. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file provides executable examples that write output files such as output_normalized.mp3, output_with_bgm.mp3, output.mp3, output.wav, and output.m4a. The guide does not include any warning that running these examples will create or replace files on disk, which is relevant user disclosure for markdown under the missing-warning rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
This markdown file contains user-facing skill guidance exclusively in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or that users can opt into another language. Under the language/locale policy check, forcing a single language without opt-in can be a policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring presents the skill entirely in Chinese, and the command-line help strings throughout the file are also Chinese-only. This imposes a specific language/locale on users without offering a language choice or documenting that the skill is intended only for a Chinese-speaking context.
- Content