WaveSpeedAI MiniMax Speech 2.6 TTS

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:02 AM UTC
• Version: 2.0.1

Overview

This skill is a coherent text-to-speech integration, but users should treat its unpinned npm CLI/MCP setup as a normal supply-chain caution.

Install only if you are comfortable using WaveSpeed AI for the text or files you submit, and prefer pinned, reviewed package versions instead of unpinned global npm or npx commands in sensitive environments. Do not paste API keys into chat; use the documented login flow or environment variable handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party npm Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18 and 25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g @wavespeed/cli

text

Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login.

Technical Analysis

The Skill directs users to install @wavespeed/cli globally and to download and immediately execute @wavespeed/mcp through npx -y. Neither dependency is pinned to a reviewed version, and no package integrity or provenance verification is required.

The global npm installation may run package lifecycle scripts and place executables in a shared user or system location. The npx -y command is particularly sensitive because it automatically accepts installation and executes the resolved package without an intermediate review step. The effective code executed by these instructions can therefore change after the Skill itself has been audited.

This is a supply-chain exposure rather than evidence that the current packages are malicious. Exploitation would require compromise of the relevant npm package, publisher account, release process, or dependency chain.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or an executed transitive dependency.
2. The attacker publishes a malicious version that is selected by npm because the Skill does not specify a fixed version.
3. A user or Agent follows the installation instructions and runs npm install -g @wavespeed/cli or npx -y @wavespeed/mcp.
4. npm retrieves the malicious release and executes its lifecycle or runtime code with the privileges of the invoking user.
5. The payload can access resource ...[truncated 1057 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin both packages to explicitly reviewed versions, such as:

   bash

   npm install @wavespeed/cli@<reviewed-version>
   npx --no-install @wavespeed/mcp@<reviewed-version>
   

2. Prefer a project-local installation over a global installation so the dependency is represented in package.json and a lockfile.
3. Commit and enforce a lockfile with integrity hashes, using a deterministic installation command such as npm ci.
4. Avoid npx -y, which automatically downloads and executes unresolved packages. Install a reviewed version first and run its local binary.
5. Verify npm publisher identity, package provenance, registry source, and signatures or attestations where available.
6. Review package lifecycle scripts and transitive dependencies before approving upgrades.
7. Run the CLI or MCP server in a restricted environment with minimum filesystem, network, and credential access.
8. Require explicit approval and security review before changing pinned dependency versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends running an MCP server via npx -y @wavespeed/mcp without pinning a specific version or integrity constraint. This creates a supply-chain risk: users may execute whatever package version is current at install time, including a compromised or malicious update, and because MCP servers often handle credentials and tool execution, compromise could expose API keys or enable arbitrary actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.