TTS AutoPlay with Wake Word

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:16 AM UTC
• Version: 2.0.1

Overview

This skill is for voice autoplay, but its install and runtime instructions rely on missing PowerShell scripts and inconsistent playback controls that users should review before installing.

Install only after verifying the actual PowerShell scripts from the package source and confirming whether playback is wake-word-only or always-on. Avoid running the commands from an elevated PowerShell session, and review the voice/language and wake-word settings because unexpected audio playback can expose private replies to nearby people.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:8
• Finding: Unpinned Package Execution and Uninspectable Installation Scripts## Vulnerability Details **File Location**: `README.md:8-14`; `SKILL.md:27-34`; `SKILL.md:72-79` **Vulnerability Type**: Unpinned third-party package execution followed by execution of scripts absent from the reviewed artifact **Risk Level**: Medium ### Vulnerable Code `README.md:8-14`: ```bash # 使用 ClawHub 安装 npx clawhub install tts-autoplay # 进入技能目录 cd skills/tts-autoplay # 运行安装脚本 powershell -ExecutionPolicy Bypass -File install.ps1 ``` `SKILL.md:27-34`: ```powershell 2. Run installation: ```powershell powershell -ExecutionPolicy Bypass -File "skills/tts-autoplay/install.ps1" ``` 3. Start with wake word detection: ```powershell powershell -ExecutionPolicy Bypass -File "skills/tts-autoplay/tts-autoplay-wakeword.ps1" ``` ``` `SKILL.md:72-79`: ```bash # Install skill clawhub install tts-autoplay cd skills/tts-autoplay # Install powershell -ExecutionPolicy Bypass -File install.ps1 # Start with wake word detection powershell -ExecutionPolicy Bypass -File tts-autoplay-wakeword.ps1 ``` ### Technical Analysis The installation instructions invoke `npx clawhub` without pinning the package to a reviewed version or integrity hash. Depending on the local environment and package availability, `npx` can retrieve and execute package code from an external registry. Consequently, the package that runs at installation time can differ from the component originally reviewed. The instructions then execute `install.ps1`, `tts-autoplay.ps1`, and `tts-autoplay-wakeword.ps1` with PowerShell execution-policy checks bypassed. None of these scripts are included in the submitted artifact, despite being listed in its documented file structure. Their implementation therefore cannot be inspected or verified against the package's claims of local-only monitoring, no external API calls, and no data collection. `-ExecutionPolicy Bypass` is not, by itself, an operating-system privilege esc ...[truncated 1734 chars]
• Remediation: ## Remediation Suggestions 1. Pin `clawhub` and the installed skill to exact, reviewed versions rather than resolving the latest available release. 2. Record and verify cryptographic integrity hashes or trusted signatures for downloaded packages and scripts before execution. 3. Include every referenced executable file—`install.ps1`, `uninstall.ps1`, `tts-autoplay.ps1`, `tts-autoplay-wakeword.ps1`, and `start.bat`—in the distributable artifact so they can be audited. 4. Remove `-ExecutionPolicy Bypass` from the standard installation instructions. Prefer properly signed scripts and a narrowly scoped execution policy. 5. Publish immutable release artifacts and verify that package-manager releases correspond exactly to the reviewed source revision. 6. Document all dependency sources, versions, checksums, network activity, filesystem changes, and permissions required by the installation scripts. 7. Run installation with ordinary user privileges and explicitly warn users not to use an elevated PowerShell session unless a documented operation strictly requires it. 8. Add automated release checks that reject packages when documented scripts are missing or their hashes differ from reviewed versions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The wake-word list includes single-character or highly generic triggers such as “念”, “读”, and “说”, which are likely to appear in ordinary conversation and can unintentionally activate voice playback. In a TTS auto-play skill, this can cause surprise audio output, privacy leakage to bystanders, or nuisance/abuse through easy triggering by normal text.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The README instructs users to invoke `npx clawhub` without pinning an exact package version, which can cause execution of a newer or compromised release at install time. Because `npx` fetches and runs remote package code, this creates a supply-chain risk rather than a purely documentation issue.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README repeatedly tells users to run local PowerShell scripts with `-ExecutionPolicy Bypass`, which suppresses an important safety control and normalizes execution of potentially untrusted script content. In the context of a downloadable skill containing multiple scripts, this materially increases the chance that harmful script logic is executed without review.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The README's example configuration sets the TTS voice and language to zh-CN and the surrounding documentation is presented as the default setup, with no indication that users may select another language or that the skill is intentionally China-specific. This can violate language/locale policy expectations when a skill implicitly forces a specific locale without opt-in.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README claims broad automatic playback behavior while the metadata says playback should only occur when wake words are present, creating a security-relevant mismatch in user expectations and consent. In a voice playback skill, undocumented always-on behavior can expose private content audibly in inappropriate environments and suggests the documented safety boundary may not be real.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documentation repeatedly claims wake-word detection is based on user messages, but later sections describe implementation that matches wake words against filenames or directory names. This mismatch can cause operators to deploy the skill under false assumptions, leading to unintended audio playback and privacy or usability issues in environments where spoken output should remain off unless explicitly requested.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The test instruction suggests that saying a normal greeting like '你好' may be sufficient during validation, which makes the activation boundary unclear and implies the feature may trigger outside explicit wake-word usage. Ambiguous activation guidance increases the chance that users misconfigure or overtrust the skill's privacy behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: Several default wake words and phrases are broad enough to appear in ordinary conversation, increasing the chance of accidental activation. In a skill whose effect is to play generated speech automatically, false positives can disclose private content audibly or create disruptive behavior in shared or quiet settings.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The examples promise user-input-triggered voice behavior, but the shown PowerShell logic checks filenames and directory names instead. If downstream systems derive file paths from model output, metadata, or other uncontrolled inputs, playback may be triggered in situations users and administrators do not expect, undermining trust and potentially exposing sensitive responses aloud.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: Custom wake words like “助手” or names such as “爪爪” and “Hey ZhaoZhao” are ambiguous and may overlap with ordinary addressing of the assistant rather than an explicit request for audio playback. This makes accidental activation more likely, especially because the skill’s purpose is to convert responses into spoken output automatically.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The configuration hard-codes the voice to "zh-CN-XiaoxiaoNeural", which imposes a specific locale and language behavior. The document does not offer a user choice, opt-in, or justification for restricting output to that locale, which conflicts with the language/locale policy criteria.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The low-priority wake words include very common terms such as '说', '念', '读', '讲', 'audio', and 'play', which are likely to appear in ordinary conversation without the user intending audio playback. In a skill whose purpose is to auto-play TTS, overly broad triggers can cause unexpected spoken output, creating privacy, nuisance, and consent issues, especially in shared or quiet environments.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The documented configuration hard-codes a Chinese voice and language without presenting user choice or an explicit opt-in path. While this is not a code-execution or injection issue, in the context of an auto-play voice skill it can lead to unexpected behavior, misaligned output for non-Chinese users, and weak consent/usability controls around how audio is produced.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The configuration hard-codes both the voice and language to zh-CN values, which indicates the skill will use a specific language/locale by default. Under the policy, locale restrictions should not be forced unless the user is given a choice or the constraint is clearly justified.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The manifest frames the skill as conditional voice playback triggered only for messages containing wake words. The README's startup instructions and overall description present it as a general-purpose auto-play service for TTS replies, without describing any wake-word filtering, creating a semantic mismatch in the advertised behavior.

Static analysis

No suspicious patterns detected.