ClawHub
Back to skill

Security audit

Qwen3-TTS Voice Synthesis

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real text-to-speech skill, but it needs review because text can leave the local machine through a configurable ComfyUI endpoint and an automatic cloud fallback.

Install only if you are comfortable with synthesis text potentially leaving your machine. Keep COMFYUI_URL set to localhost or a trusted ComfyUI server, use --fallback-edge false for sensitive text, and use voice cloning only with audio you are authorized to process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tainted flow: 'req' from os.environ.get (line 179, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read())
            return result.get("prompt_id")
    except (urllib.error.URLError, urllib.error.HTTPError) as e:
Confidence
89% confidence
Finding
with urllib.request.urlopen(req, timeout=30) as resp:

Tainted flow: 'url' from os.environ.get (line 198, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
while time.time() - start < timeout:
        try:
            url = f"{COMFYUI_URL}/history/{prompt_id}"
            with urllib.request.urlopen(url, timeout=10) as resp:
                history = json.loads(resp.read())
                if prompt_id in history:
                    status = history[prompt_id].get("status", {})
Confidence
87% confidence
Finding
with urllib.request.urlopen(url, timeout=10) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation describes capabilities that imply shell execution, file I/O, environment access, and network use, but no permissions are declared. This creates a trust and review gap: operators may treat the skill as lower risk than it is, while it can access local services and write output files. In a voice skill, these capabilities may be expected, but they still need explicit declaration for safe deployment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding
The documented behavior does not fully match the implemented behavior: the skill claims local TTS with multi-role support, but analysis indicates incomplete implementation and undocumented local HTTP interaction with ComfyUI. Behavior mismatches are dangerous because users and reviewers may not understand actual data flows, dependencies, or failure modes, especially where text may be sent to external services or local APIs.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill is presented as 'local' TTS, but the documented fallback uses Edge TTS, which is cloud-based. This is a material security and privacy discrepancy because users may provide sensitive text believing processing remains on-device, when it may instead be transmitted to a remote provider during fallback.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The skill is presented as local TTS, but on failure it transparently delegates text to another skill associated with Edge TTS, introducing behavior inconsistent with the advertised local-only model. That mismatch can cause unexpected data disclosure or policy bypass if users assume their content never leaves the local synthesis path.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Automatic fallback to a cloud TTS provider without a clear user warning can expose sensitive or private text unexpectedly. Because fallback is automatic, users may not realize their input is leaving the local environment, which is particularly risky for personal, proprietary, or regulated content.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
A default-enabled cloud fallback without an explicit privacy warning creates silent data exfiltration risk from the user's perspective. Even if intended as a reliability feature, enabling it by default means sensitive text can be sent off-device during normal error handling without informed consent.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
User-supplied text is sent over HTTP to the ComfyUI API with no explicit notice that content leaves the process boundary. In the context of a TTS skill marketed as local synthesis, this omission is more dangerous because users may supply sensitive narration or transcripts under a mistaken privacy assumption.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.