Edge TTS — Text-to-Speech

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.2.0

Overview

The skill performs text-to-speech, but it includes code-loading and setup instructions that could run unreviewed third-party Python code.

Review before installing. Use a dedicated virtual environment with pinned dependencies, remove the hard-coded /home/vincent sys.path override, and avoid the optional FunASR trust_remote_code example unless it is pinned and sandboxed. Do not submit sensitive text to Edge TTS unless you are comfortable sending it to Microsoft-operated cloud TTS infrastructure.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:70

Finding

Unpinned Remote Model Code Can Execute Locally

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 70-75
Vulnerability Type: Remote payload execution through a mutable model repository and unpinned dependencies
Risk Level: High

Complete Code Snippet:

bash

pip install funasr modelscope
# Download model from ModelScope
python -c "
from funasr import AutoModel
model = AutoModel(model='iic/SenseVoiceSmall', trust_remote_code=True, device='cuda:0')
result = model.generate(input='test.wav')

Technical Analysis

The documented call enables trust_remote_code=True, allowing Python code supplied by the remote model repository to execute on the local system. The model identifier does not specify an immutable revision, commit, or verified artifact hash. The funasr and modelscope packages are also installed without pinned versions or hashes.

Consequently, the code ultimately executed by a user can change after this Skill has been reviewed. Compromise of the model publisher, model repository, package publisher, dependency chain, or delivery infrastructure could result in arbitrary Python execution.

This behavior appears in optional documentation and is not automatically invoked by scripts/tts.py. Exploitation therefore requires a user to follow the documented alternative ASR setup.

Attack Path

1. An attacker compromises the referenced model repository, publisher account, dependency, or package distribution channel.
2. The attacker introduces malicious Python code into a model revision or dependency that remains compatible with the documented mutable identifiers.
3. A user follows the README and installs the unpinned packages.
4. The user executes the documented AutoModel call with trust_remote_code=True.
5. The malicious remote code executes with the same operating-system privileges and environment access as the invoking user.

Impact Assessment

Successful exploitation permits arbitrary code execution with the invo ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

• Remove trust_remote_code=True and use a model implementation provided by a reviewed, locally installed library whenever possible.
• If remote model code is unavoidable, pin the model to a reviewed immutable commit or revision.
• Verify downloaded model files and code against cryptographic hashes or signed release metadata.
• Pin funasr, modelscope, and their transitive dependencies to reviewed versions and install them using a hash-locked requirements file.
• Load third-party models in a sandbox or container with no sensitive mounts, minimal filesystem permissions, restricted outbound networking, and no inherited credentials.
• Explicitly warn users that enabling remote model code executes third-party Python and is not required for the core TTS function.

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/tts.py:1

Finding

Hard-Coded Import Path Can Override the Intended Edge TTS Package

Content

View full analysis

Vulnerability Details

File Location: scripts/tts.py, lines 1-4
Vulnerability Type: Python module search-path hijacking
Risk Level: Medium

Complete Code Snippet:

python

#!/usr/bin/env python3
# Uses comfyui-venv for edge-tts dependency
import sys
sys.path.insert(0, '/home/vincent/comfyui-venv/lib/python3.12/site-packages')

The affected import subsequently occurs at scripts/tts.py, lines 13-14:

python

import edge_tts
from edge_tts import SubMaker

Technical Analysis

The script inserts a user-specific external directory at the beginning of sys.path. Python therefore searches this directory before the normal interpreter environment when resolving edge_tts and any other imports performed afterward.

The prioritized directory is outside the reviewed project and may contain stale, unexpected, or attacker-controlled modules. If another principal can write to that path, or if its package installation is compromised, a malicious edge_tts package can execute immediately during import. The absolute /home/vincent path also makes the Skill non-portable and causes its effective dependency source to differ across systems.

Attack Path

1. An attacker obtains write access to /home/vincent/comfyui-venv/lib/python3.12/site-packages, or compromises a package installed there.
2. The attacker creates or modifies an edge_tts module containing malicious import-time code.
3. A user launches scripts/tts.py.
4. The script prepends the external directory to sys.path.
5. Python imports the attacker-controlled module before any legitimate package from the active environment.
6. The module's top-level code executes with the invoking user's privileges.

Exploitation depends on the external directory existing and being writable or otherwise compromised; the project does not itself create or modify that directory.

Impact Assessment

Successful exploitation allows arbitra ...[truncated 325 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hard-coded sys.path.insert call.
• Declare edge-tts as a normal pinned project dependency and install it in a dedicated virtual environment.
• Launch the script using that virtual environment's interpreter rather than redirecting module resolution at runtime.
• Use a lockfile or hash-locked requirements file to verify the exact dependency artifact.
• Ensure dependency directories are writable only by their owning administrative or application account.
• Consider validating the imported package version and location during deployment rather than manipulating sys.path in application code.

T08 · Insecure Dependencies

Warning

• Location: README.md:37

Finding

Documentation Installs Mutable Third-Party Packages Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 37, 54, and 70; SKILL.md, line 75
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippets:

README.md, line 37:

bash

pip install cosyvoice

README.md, line 54:

bash

pip install openai-whisper

README.md, line 70:

bash

pip install funasr modelscope

SKILL.md, line 75:

markdown

- `edge-tts` (pip install)

Technical Analysis

The installation guidance does not pin package versions, constrain transitive dependencies, or require artifact hashes. Each installation can therefore resolve to different code depending on the package index state at the time of use.

Python packages and their dependencies can execute code during installation or later import. If a publisher account, release artifact, package index, or transitive dependency is compromised, users following these instructions may install malicious code. Even without an attacker, mutable versions can introduce incompatible or newly vulnerable behavior after the Skill has been audited.

The funasr and modelscope instruction also contributes to the separate remote-model-code issue. This finding covers the broader absence of dependency version and integrity controls across all documented package installations.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or its distribution account or channel.
2. A malicious release becomes the version selected by an unpinned pip install command.
3. A user follows the project documentation.
4. pip downloads and installs the mutable malicious package or dependency.
5. Malicious code executes during installation or when the package is imported and used.

Impact Assessment

A compromised dependency can execute with the privileges of the user running pip or the application. If installation is perfor ...[truncated 281 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unconstrained installation commands with reviewed, exact package versions.
• Maintain a lockfile that pins direct and transitive dependencies.
• Use pip --require-hashes with cryptographic hashes for all resolved artifacts.
• Install dependencies inside a dedicated, non-privileged virtual environment.
• Regularly scan locked dependencies for known vulnerabilities and update them through a controlled review process.
• Document the supported Python version and trusted package index.
• Avoid installing packages as root or with unrestricted administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation describes file read and file write behavior (--file input and --output path) but does not declare any tool scope or permissions boundaries. In an agent environment, this can lead to overly broad or implicit filesystem access, making it easier for the skill to read unintended local files or overwrite arbitrary paths if invoked with attacker-controlled arguments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends provided text to Microsoft's Edge TTS service via the edge_tts library, but it does not disclose to the user that input text leaves the local environment and is processed by an external provider. This can expose sensitive prompts, documents, or personal data if users assume the skill is fully local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation prescribes only Chinese-recommended voices and presents Chinese as the default interaction mode, while the file elsewhere notes that the TTS system supports 50+ languages. This creates a natural-language locale preference without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

If the text does not match the specific Chinese, Japanese, or Korean regexes, the script silently selects en-US-JennyNeural. This imposes a specific locale by default rather than prompting the user or clearly offering an opt-in language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.