Security audit

Beep · 小喇叭

Security checks for vulnerabilities and agentic risk

Overview

This is a real voice-announcement skill, but it makes speech mandatory and persistent in ways that could expose sensitive prompts or replies.

Install only if you explicitly want always-on spoken announcements. Review or skip the suggested edits to core agent files and hooks, avoid speaking secrets or personal data, and assume announcement text may leave the machine through edge-tts and may remain in local audio cache files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

Low

Confidence: 90% confidence
Finding: The fallback import path modifies sys.path to load Python code from a user-writable skill directory in the home folder. If that directory or the audio_announcement package there is replaced or tampered with, running this script can import and execute unintended code, creating a code-loading integrity risk even though no subprocess is used.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The function sends full announcement text to edge_tts, which typically involves an external cloud-backed TTS service, without any explicit consent prompt, warning, or data-classification check at the point of transmission. If callers pass sensitive operational data, secrets, user messages, or internal task content, that data may be disclosed to a third party unexpectedly.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly requires voice broadcast on every interaction, including when messages are received and replies are sent. That creates a clear channel for unintended disclosure of sensitive prompts, credentials, personal data, or operational details to anyone nearby, and the mandatory nature of the rule makes it more dangerous in real-world environments.

Ssd 3

High

Confidence: 99% confidence
Finding: This integration text specifically instructs the agent to announce user instruction content and summarize outgoing responses before sending them. In context, that materially increases the risk of plain-language leakage of confidential inputs, system outputs, internal workflow details, and potentially secrets contained in prompts or generated replies; the extensive cross-file propagation into AGENTS.md, MEMORY.md, IDENTITY.md, and hooks makes the behavior persistent and harder to avoid.

Static analysis

No suspicious patterns detected.