Text To Podcast

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This TTS skill mostly matches its stated purpose, but its install and uninstall scripts can write or delete configuration and output files in the parent directory instead of the skill directory.

Review or fix the install and uninstall scripts before installing. Do not run them with elevated privileges, prefer an isolated virtual environment with pinned dependencies, and verify the exact .env and output paths before entering an API key or confirming cleanup. Avoid processing confidential text unless you are comfortable sending it to OpenAI's TTS API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:14

Finding

Unpinned Third-Party Packages Are Installed into the Active Python Environment

Content

View full analysis

=1.0.0", "python-dotenv>=1.0.0"], ``` Location: `skill.json:8` ### Technical Analysis The installation script asks `pip3` to resolve and install the latest available versions of `openai` and `python-dotenv`. It does not use exact versions, integrity hashes, a lock file, or an isolated virtual environment. Consequently, the code installed by the skill can differ from the code that was reviewed. A compromised package release, compromised transitive dependency, or future malicious release could execute code during installation or when imported by `source/podcast_generator.py`. The direct package names are legitimate and there is no evidence that this project intentionally references a malicious package; the vulnerability is the absence of supply-chain controls. The bare `pip3` command also installs into whichever Python environment is active. This can alter a shared user or system environment and affect unrelated applications. ### Attack Path 1. An attacker compromises a permitted package release or one of its transitive dependencies. 2. The malicious release remains compatible with the unconstrained installation command. 3. A user runs `install.sh`. 4. `pip3` downloads and installs the currently resolved release without checking a project-supplied hash. 5. Malicious installation hooks or imported package code execute with the privileges of the user running the installer. 6. If the user runs the installer under an elevated account, the dependency code receives those elevated privileges. ### Impact Assessment Successful exploitation can execute arbitrary ...[truncated 578 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: uninstall.sh:4

Finding

Incorrect Base Directory Causes Shared Parent Configuration Writes and Unsafe Recursive Cleanup

Content

View full analysis

"$BASE_DIR/.env" << 'EOF' OPENAI_API_KEY=your-api-key-here EOF echo "⚠️ 请编辑 $BASE_DIR/.env 文件，填入你的 OPENAI_API_KEY" fi # 创建输出目录 mkdir -p "$BASE_DIR/output" ``` Location: `install.sh:19-29` In contrast, the Python runtime correctly treats the project root as its base directory: ```python BASE_DIR = Path(__file__).parent.parent load_dotenv(BASE_DIR / ".env") ``` Location: `source/podcast_generator.py:11-12` ### Technical Analysis Because `install.sh` and `uninstall.sh` are already in the project root, `SCRIPT_DIR` is the skill directory. Applying `dirname` again makes `BASE_DIR` the skill’s parent, potentially a shared skills or workspace directory. This produces two security-relevant effects: 1. Installation writes `.env` and creates `output` outside the skill’s own directory. A parent-level `.env` may be shared with unrelated components and may contain credentials that are not owned by this skill. 2. When cleanup is confirmed, uninstallation deletes the parent-level ` ...[truncated 1962 chars]

Remediation

View remediation

&2; exit 1 ;; esac ``` 4. Delete only resources that the installer created. Consider recording created paths in an installation manifest. 5. Do not delete an existing `.env` unless ownership by this skill can be established. A safer design is to use a skill-specific configuration filename or directory. 6. Create secret-bearing files with restrictive permissions: ```bash umask 077 ``` 7. Retain the confirmation prompt, but display the canonical paths that will be removed before accepting confirmation. 8. Add installation and uninstallation tests that assert every created or deleted path remains beneath the project root. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose is only text-to-speech conversion, but the detected behavior includes uninstall/cleanup actions and deletion of local config or output files. Hidden destructive behavior outside the stated purpose is dangerous because users may grant trust or run the skill expecting only media generation, while it can also remove files or alter local state.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 20)May include surrounding context.

sh

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 22)May include surrounding context.

sh

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 26)May include surrounding context.

sh

echo "📦 安装 Python 依赖..."
pip3 install openai python-dotenv --quiet

# 创建 .env 配置
if [ ! -f "$BASE_DIR/.env" ]; then
    echo "📝 创建 .env 配置文件..."
    cat > "$BASE_DIR/.env" << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 21)May include surrounding context.

sh

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 23)May include surrounding context.

sh

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · source/podcast_generator.py (reported line 13)May include surrounding context.

python

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · uninstall.sh (reported line 13)May include surrounding context.

sh

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 13)May include surrounding context.

sh

read -p "删除配置和输出文件？(y/N): " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · uninstall.sh (reported line 14)May include surrounding context.

sh

echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    rm -f "$BASE_DIR/.env"
    rm -rf "$BASE_DIR/output"
    echo "✅ 已删除"
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill documentation instructs users to run an install script and use environment variables and local files, but it declares no explicit tool scope or permissions. In an agent ecosystem, missing scope makes the skill's effective capabilities opaque, which can lead to over-broad execution privileges and unsafe invocation of shell or file operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill says it uses the OpenAI TTS API but does not clearly warn that user-provided text may be transmitted to a third-party service during conversion. This creates a privacy and compliance risk, especially if users process sensitive drafts, internal documents, or regulated content under the assumption processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description is written entirely in Chinese and presents the skill's function in that language without indicating that users can choose another language or locale. This can violate language/locale policy when a skill implicitly enforces a specific language without documented opt-in or a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Most runtime messages, help text, and command descriptions are presented in Chinese, so the skill effectively enforces a specific language for interaction. The file does not offer a user-selectable language or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends the full user-provided text to OpenAI's external TTS API, which can disclose sensitive or proprietary content to a third party if users assume processing is local. Because there is no explicit consent prompt, warning, or data-handling notice, users may unknowingly transmit confidential material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Natural-language content in the manifest description and main documentation is presented in Chinese without indicating that this skill is intentionally region- or language-specific. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's user-facing messages are written in Chinese, including installation status and usage guidance, with no indication that another language is available. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a text-to-podcast conversion skill, but the code also loads a .env file and reads OPENAI_API_KEY from the environment before doing any work. While networked TTS itself is consistent with the purpose, credential file/environment access is an additional capability not reflected in the stated scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's prompts and status messages are presented only in Chinese, including the deletion confirmation and completion messages. This can violate a language/locale policy when the skill does not offer user opt-in or explain that it is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.