Security audit

Chinese TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to make Chinese voice audio, but it can send user-provided text to external services and Feishu under broad triggers without clear confirmation.

Review before installing. Use it only when users explicitly want Chinese text converted to a Feishu voice message, avoid secrets or confidential content, and add a confirmation step plus a privacy notice before any external TTS call or Feishu send.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The implemented behavior matches the Chinese TTS generation portion of the description: it accepts text, uses a Chinese default voice, and produces an Opus file suitable for Feishu. However, the description explicitly claims the skill will also send the audio as a Feishu voice message, and there is no Feishu API call, upload, or message-send logic in this code chunk. This is a material description-behavior mismatch because a key declared capability—sending via Feishu—is absent from the actual code.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The invocation description uses very broad trigger phrases such as voice/audio/语音/播报/朗读, which can match common user requests and cause the skill to activate in situations the user did not specifically intend. Because this skill sends generated content outward as a Feishu voice message, over-broad activation can lead to unintended message transmission, privacy issues, or surprising actions on the user's behalf.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill is framed as always producing Chinese output without making clear that this should depend on user preference or explicit opt-in. In practice, this can cause the system to transform user content into a different language or modality than requested and then send it externally via Feishu, increasing the risk of miscommunication, accidental disclosure, or actions the user did not intend.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script forwards arbitrary input text to `edge-tts`, which typically relies on an external service, creating a data exfiltration/privacy risk for any sensitive content included in the text. In this skill context, that behavior is central to the feature, but there is no warning, consent mechanism, or filtering to prevent secrets, personal data, or internal information from being transmitted off-host.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The script unconditionally exports `LANG=en_US.UTF-8` and `LC_ALL=en_US.UTF-8`, overriding the user's locale settings. This is a natural-language/locale policy concern because it imposes a specific locale without offering choice or documenting why it is required.

Static analysis

No suspicious patterns detected.