ClawHub
Back to skill

Security audit

chattts_local

Security checks for vulnerabilities and agentic risk

Overview

The skill does local text-to-speech, but it can automatically install unpinned Python packages and download model files despite being framed as fully local.

Review before installing. Use this only in an isolated virtual environment or container, preinstall trusted pinned dependencies yourself, and expect first-run network downloads for ChatTTS model files. Do not treat it as offline-only until setup is complete and the downloaded artifacts are verified.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
return True
    except ImportError:
        print("正在安装依赖...")
        os.system("pip install ChatTTS torch torchaudio -q")
        try:
            import ChatTTS
            return True
Confidence
96% confidence
Finding
The script invokes a shell command to install packages at runtime via os.system("pip install ..."). This introduces command-execution and supply-chain risk because execution now depends on external package indexes, network state, and whatever package versions resolve at runtime, which is especially dangerous for a skill advertised as local/offline TTS.

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation indicates capabilities to read files, access environment context, and execute shell commands, yet it declares no permissions. This creates a trust and review gap: operators may approve or invoke the skill without understanding that it can run commands and interact with the local system, increasing the chance of unintended command execution or access to sensitive local resources.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims to be fully local and simple TTS, but the documented behavior includes external model downloads and runtime package installation. That mismatch is dangerous because users may trust it as offline-only while it performs network access and executes package-management commands, exposing the environment to supply-chain risk, unexpected outbound connections, and non-deterministic behavior.

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
The claim of being 'fully local' conflicts with the note that the first run downloads a model. While this is primarily a transparency issue, it can still mislead users in restricted or sensitive environments where any network access is prohibited, causing policy violations or unexpected data egress to external hosting services.

Description-Behavior Mismatch

High
Confidence
93% confidence
Finding
The manifest claims the skill is completely local and requires no external service, but the code installs dependencies and later downloads models from remote sources at runtime. This mismatch is security-relevant because users may trust the skill as offline/local-only when it actually performs unexpected network activity and fetches executable code and model artifacts.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
A text-to-speech skill does not need shell execution to fulfill its core purpose, so dynamically invoking pip from inside the skill is unjustified privileged behavior. In context, this increases the risk profile because the skill can modify the host Python environment and import newly fetched code without clear user review.

Intent-Code Divergence

Medium
Confidence
84% confidence
Finding
The module documentation describes a local text-to-speech script, but the implementation also installs packages and downloads models remotely. This hidden behavior weakens informed consent and can cause administrators to run code under false assumptions about network access and environment modification.

Vague Triggers

Medium
Confidence
77% confidence
Finding
The trigger examples are broad natural-language phrases that overlap with ordinary conversation, making accidental activation more likely. In a skill that can execute local scripts and produce files, false triggering could cause unintended command runs, resource consumption, or generation and transmission of audio outputs without clear user intent.

Static analysis

No suspicious patterns detected.