FlowVoice — Clone Any Voice From a Short Audio Sample

• Outcome: Review
• Latest audit: May 29, 2026 · 9:27 PM UTC
• Version: 1.1.0

Overview

This is a disclosed local voice-cloning skill, but it needs Review because it enables easy impersonation without consent guardrails and stores reusable voice profiles.

Install only if you will use it for your own voice or voices you have explicit permission to clone. Do not clone people from social media or public recordings without authorization, do not load .pkl voice profiles from others, and delete or protect saved profiles because they can be reused to generate speech in that voice.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs the agent to execute shell commands (`uv`, `ffmpeg`, and even `yt-dlp`) but declares no permissions or trust boundary information. That mismatch can cause an agent or platform to run powerful local commands without appropriate user awareness, review, or sandboxing, increasing the risk of unintended file access, network use, and command execution.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill is explicitly designed to clone voices from arbitrary samples and generate impersonating audio, yet it provides no consent, authorization, or anti-impersonation guidance. In this context, the missing safety framing materially increases misuse risk for fraud, harassment, deception, and privacy violations, because the feature is dangerous by design if applied to non-consenting third parties.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented 'clone voice from URL' workflow encourages downloading and processing third-party audio directly from remote sources without any warning about consent, copyright, privacy, or provenance. This makes it easier to ingest unauthorized content and clone voices from social platforms or other public media, amplifying legal and abuse risks beyond local-file-only usage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script persists cloned voice embeddings to disk with `pickle` and also writes generated media without any consent notice, retention controls, or privacy warning. In a voice-cloning context, silent storage of biometric-like voice profiles materially increases privacy and misuse risk because reusable impersonation artifacts remain on disk beyond the immediate task.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: The skill explicitly markets unrestricted voice cloning without any consent, authorization, or anti-impersonation constraints. In this skill context, that materially increases abuse potential for fraud, impersonation, social engineering, and non-consensual biometric replication, making the functionality more dangerous than generic media tooling.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.