Text To Podcast

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This TTS skill mostly matches its stated purpose, but its install and uninstall scripts can write or delete configuration and output files in the parent directory instead of the skill directory.

Review or fix the install and uninstall scripts before installing. Do not run them with elevated privileges, prefer an isolated virtual environment with pinned dependencies, and verify the exact .env and output paths before entering an API key or confirming cleanup. Avoid processing confidential text unless you are comfortable sending it to OpenAI's TTS API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:14
• Finding: Unpinned Third-Party Packages Are Installed into the Active Python Environment<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:14-16` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # 安装依赖 echo "📦 安装 Python 依赖..." pip3 install openai python-dotenv --quiet ``` The package metadata also permits any version equal to or newer than the specified minimum: ```json "requirements": ["openai>=1.0.0", "python-dotenv>=1.0.0"], ``` Location: `skill.json:8` ### Technical Analysis The installation script asks `pip3` to resolve and install the latest available versions of `openai` and `python-dotenv`. It does not use exact versions, integrity hashes, a lock file, or an isolated virtual environment. Consequently, the code installed by the skill can differ from the code that was reviewed. A compromised package release, compromised transitive dependency, or future malicious release could execute code during installation or when imported by `source/podcast_generator.py`. The direct package names are legitimate and there is no evidence that this project intentionally references a malicious package; the vulnerability is the absence of supply-chain controls. The bare `pip3` command also installs into whichever Python environment is active. This can alter a shared user or system environment and affect unrelated applications. ### Attack Path 1. An attacker compromises a permitted package release or one of its transitive dependencies. 2. The malicious release remains compatible with the unconstrained installation command. 3. A user runs `install.sh`. 4. `pip3` downloads and installs the currently resolved release without checking a project-supplied hash. 5. Malicious installation hooks or imported package code execute with the privileges of the user running the installer. 6. If the user runs the installer under an elevated account, the dependency code receives those elevated privileges. ### Impact Assessment Successful exploitation can execute arbitrary ...[truncated 578 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a dedicated virtual environment for this skill rather than modifying the active Python environment. 2. Pin every direct and transitive dependency to an exact, reviewed version. 3. Generate a hash-locked requirements file and install it with integrity enforcement: ```bash python3 -m venv "$SCRIPT_DIR/.venv" "$SCRIPT_DIR/.venv/bin/python" -m pip install --require-hashes -r requirements.lock ``` 4. Generate `requirements.lock` with a trusted locking tool and include SHA-256 hashes for every permitted artifact. 5. Use `python3 -m pip` from the intended interpreter instead of an unqualified `pip3`. 6. Review dependency updates before regenerating the lock file and use automated dependency vulnerability scanning. 7. Avoid instructing users to run the installer with elevated privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: uninstall.sh:4
• Finding: Incorrect Base Directory Causes Shared Parent Configuration Writes and Unsafe Recursive Cleanup<![CDATA[ ## Vulnerability Details **File Location**: `uninstall.sh:4-14` **Vulnerability Type**: Incorrect path derivation and unsafe recursive deletion **Risk Level**: Medium ### Vulnerable Code The uninstall script treats the parent of the skill directory as its base directory and recursively removes an `output` directory there: ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_DIR="$(dirname "$SCRIPT_DIR")" echo "🗑️ 卸载 text-to-podcast..." read -p "删除配置和输出文件？(y/N): " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then rm -f "$BASE_DIR/.env" rm -rf "$BASE_DIR/output" echo "✅ 已删除" fi ``` The same incorrect shell path derivation is used during installation: ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" BASE_DIR="$(dirname "$SCRIPT_DIR")" ``` Location: `install.sh:4-5` It then creates configuration and output resources in that parent directory: ```bash if [ ! -f "$BASE_DIR/.env" ]; then echo "📝 创建 .env 配置文件..." cat > "$BASE_DIR/.env" << 'EOF' OPENAI_API_KEY=your-api-key-here EOF echo "⚠️ 请编辑 $BASE_DIR/.env 文件，填入你的 OPENAI_API_KEY" fi # 创建输出目录 mkdir -p "$BASE_DIR/output" ``` Location: `install.sh:19-29` In contrast, the Python runtime correctly treats the project root as its base directory: ```python BASE_DIR = Path(__file__).parent.parent load_dotenv(BASE_DIR / ".env") ``` Location: `source/podcast_generator.py:11-12` ### Technical Analysis Because `install.sh` and `uninstall.sh` are already in the project root, `SCRIPT_DIR` is the skill directory. Applying `dirname` again makes `BASE_DIR` the skill’s parent, potentially a shared skills or workspace directory. This produces two security-relevant effects: 1. Installation writes `.env` and creates `output` outside the skill’s own directory. A parent-level `.env` may be shared with unrelated components and may contain credentials that are not owned by this skill. 2. When cleanup is confirmed, uninstallation deletes the parent-level ` ...[truncated 1962 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use the script directory itself as the skill base in both shell scripts: ```bash SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd -P)" BASE_DIR="$SCRIPT_DIR" ``` 2. Keep installation and runtime path calculations consistent so that `.env` and `output` are located beneath the project root. 3. Before deletion, canonicalize the target and verify that it is a direct child of the expected skill root: ```bash OUTPUT_DIR="$BASE_DIR/output" case "$OUTPUT_DIR" in "$SCRIPT_DIR"/output) rm -rf -- "$OUTPUT_DIR" ;; *) echo "Refusing unsafe cleanup path" >&2; exit 1 ;; esac ``` 4. Delete only resources that the installer created. Consider recording created paths in an installation manifest. 5. Do not delete an existing `.env` unless ownership by this skill can be established. A safer design is to use a skill-specific configuration filename or directory. 6. Create secret-bearing files with restrictive permissions: ```bash umask 077 ``` 7. Retain the confirmation prompt, but display the canonical paths that will be removed before accepting confirmation. 8. Add installation and uninstallation tests that assert every created or deleted path remains beneath the project root. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is only text-to-speech conversion, but the detected behavior includes uninstall/cleanup actions and deletion of local config or output files. Hidden destructive behavior outside the stated purpose is dangerous because users may grant trust or run the skill expecting only media generation, while it can also remove files or alter local state.

Credential Access

High

• Category: Privilege Escalation

Content

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documentation instructs users to run an install script and use environment variables and local files, but it declares no explicit tool scope or permissions. In an agent ecosystem, missing scope makes the skill's effective capabilities opaque, which can lead to over-broad execution privileges and unsafe invocation of shell or file operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill says it uses the OpenAI TTS API but does not clearly warn that user-provided text may be transmitted to a third-party service during conversion. This creates a privacy and compliance risk, especially if users process sensitive drafts, internal documents, or regulated content under the assumption processing is local.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The manifest description is written entirely in Chinese and presents the skill's function in that language without indicating that users can choose another language or locale. This can violate language/locale policy when a skill implicitly enforces a specific language without documented opt-in or a region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Most runtime messages, help text, and command descriptions are presented in Chinese, so the skill effectively enforces a specific language for interaction. The file does not offer a user-selectable language or document a justified locale restriction.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill sends the full user-provided text to OpenAI's external TTS API, which can disclose sensitive or proprietary content to a third party if users assume processing is local. Because there is no explicit consent prompt, warning, or data-handling notice, users may unknowingly transmit confidential material.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: Natural-language content in the manifest description and main documentation is presented in Chinese without indicating that this skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The script's user-facing messages are written in Chinese, including installation status and usage guidance, with no indication that another language is available. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest describes a text-to-podcast conversion skill, but the code also loads a .env file and reads OPENAI_API_KEY from the environment before doing any work. While networked TTS itself is consistent with the purpose, credential file/environment access is an additional capability not reflected in the stated scope.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The script's prompts and status messages are presented only in Chinese, including the deletion confirmation and completion messages. This can violate a language/locale policy when the skill does not offer user opt-in or explain that it is intended only for Chinese-speaking users.

Static analysis

No suspicious patterns detected.