ClawHub
Back to skill

Security audit

Snowvoice Tts

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed local Chinese text-to-speech helper, but its setup runs an unpinned remote installer with broad user-level command authority.

Review before installing. Only run setup if you trust the SnowVoice upstream repository and are comfortable letting its current install.sh execute with your user account permissions. Prefer a pinned, verified release or inspect the cloned installer first; do not allow automatic setup from a casual text-to-speech request.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/init.py:20
Finding

Unpinned Remote Repository Is Retrieved and Executed During Setup

Content
View full analysis
Remediation
View remediation
git -C checkout --detach test "$(git -C rev-parse HEAD)" = "" ``` 4. Do not trust an installation merely because its directory and files exist. For pre-existing directories, validate the repository origin, exact commit, expected file digests, ownership, and permissions. Abort on any mismatch. 5. Vendor and audit the required installation logic where practical, or replace the general-purpose shell installer with explicit installation steps using version-pinned dependencies and hash verification. 6. Execute installation with the least privileges possible and clearly require user confirmation before running remotely sourced code. 7. Treat installer failure and timeout as failure. The current logic may report success after a nonzero installer result or timeout, which can leave an unverified partial installation available for later use. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose presents the skill as a local TTS utility, but the documented behavior also includes repository cloning, environment setup, dependency installation, and multi-gigabyte model downloads. This mismatch is dangerous because users or orchestrators may approve the skill expecting simple audio generation while it actually performs network access and system modifications with a much larger trust and attack surface.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents shell-capable behavior such as running Python commands, installation scripts, cloning a repository, and downloading models, but it declares no explicit tool scope or permission boundaries. That creates an authorization gap where an agent may invoke shell actions without a clear least-privilege contract, increasing the risk of unexpected command execution or overbroad access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrases are very broad, everyday requests like converting text to speech or reading text aloud, which can cause the skill to activate in routine conversations without strong user intent to run this specific local tool. In this skill's context, unintended activation is more dangerous because activation can lead not only to synthesis but also to setup checks, installation guidance, shell execution, and potential downloads.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring presents the skill description and operating instructions entirely in Chinese, with no indication that language is selectable or user-driven. This can violate a language/locale policy when a skill implicitly forces one language without offering opt-in or alternatives.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/init.py (reported line 29)May include surrounding context.

python
def run_cmd(cmd, **kwargs):
    """运行命令，返回 (returncode, stdout, stderr)"""
    result = subprocess.run(cmd, capture_output=True, text=True, **kwargs)
    return result.returncode, result.stdout, result.stderr

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The initializer clones a remote GitHub repository and then executes its install.sh locally, which is effectively remote code execution at install time. In an agent skill context, this is especially dangerous because a user invoking a TTS capability would not reasonably expect arbitrary third-party code fetch-and-execute behavior, and the script performs no pinning, signature verification, or content validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code's natural-language interface, usage text, and descriptive strings are presented only in Chinese, which effectively constrains the skill to a specific language. The file does not indicate that the language restriction is optional, user-selectable, or justified as a region-specific tool.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts_skill.py (reported line 72)May include surrounding context.

python
cmd = [python, "-m", "cli.app"] + args
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The description repeatedly frames the skill as a Chinese-only tool ('本地中文语音合成工具', '本地中文语音合成 Skill') without indicating that users may choose another language or that the restriction is an intentional, justified locale constraint. Under the policy, language constraints should either be optional for the user or clearly documented as region- or compliance-specific.

Content

No source excerpt is available for this finding.