ClawHub
Back to skill

Security audit

Kokoro Tts Amx

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real local text-to-speech skill, but its installer has risky install behavior that users should review before running.

Install only if you are comfortable reviewing and running shell setup steps. Prefer cloning a specific reviewed commit and running the installer locally after inspection; avoid the curl-to-bash one-liner, watch for the sudo prompt, and back up or check any existing kokoro-tts-amx skill directory before installation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:18
Finding

Unverified Remote Installation Script Executed from a Mutable Branch

Content
View full analysis

Vulnerability Details

File Location: README.md:18-19
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash
curl -fsSL https://raw.githubusercontent.com/Wray151/xeontts/main/install.sh \
  | REPO_URL=https://github.com/Wray151/xeontts bash

Technical Analysis

The documented installation command retrieves a shell script from the mutable main branch of a personal GitHub repository and passes the response directly to bash. It does not pin a reviewed commit, verify a cryptographic checksum, validate a signature, or provide an inspection boundary before execution.

Consequently, the effective installer can change after this version of the Skill has been audited. Compromise of the repository, maintainer account, release process, or an authorized but malicious update could turn the documented command into an arbitrary code-execution channel.

This behavior exceeds the minimum privileges required for local text-to-speech operation. Downloading model data and dependencies is relevant to the declared function, but executing an unverified, mutable remote shell program is not necessary.

Attack Path

  1. An attacker compromises the Wray151/xeontts repository, its maintainer account, or another mechanism capable of changing main/install.sh.
  2. The attacker replaces or modifies the remote installer with commands that steal files, alter the environment, establish persistence, or download additional payloads.
  3. A user or AI agent follows the README and executes the pipe-to-shell command.
  4. curl retrieves the attacker-controlled version without committing it to a reviewable local file.
  5. bash immediately executes the response with the privileges of the invoking user.
  6. Because the legitimate installer is expected to invoke sudo apt-get, a malicious replacement could also request elevated execution in a context where users expect a privilege ...[truncated 579 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation method from the README and installer comments.
  2. Require users to clone or download a specific reviewed commit rather than the mutable main branch.
  3. Publish release artifacts with SHA-256 checksums and preferably cryptographic signatures.
  4. Download the installer to a local file, verify its checksum or signature, and permit inspection before execution.
  5. Separate privileged system-package installation from the project installer. Document sudo apt-get install -y espeak-ng as an explicit user-controlled prerequisite.
  6. Use a command resembling the following pattern:
bash
git clone https://github.com/Wray151/xeontts.git
cd xeontts
git checkout <reviewed-commit-hash>
sha256sum -c install.sh.sha256
bash install.sh
  1. Protect repository releases through branch protection, mandatory review, signed commits or tags, and multi-factor authentication.

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Python Dependencies Are Not Reproducibly Pinned or Hash-Verified

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Insecure dependency resolution
Risk Level: Medium

Vulnerable Code:

text
torch>=2.3
kokoro>=0.9.4
misaki[zh]>=0.9.4
numpy

The dependencies are installed by install.sh:39:

bash
pip install -r "$REPO_DIR/requirements.txt"

Technical Analysis

The dependency file uses minimum-version constraints for three packages and leaves numpy entirely unconstrained. It does not provide exact versions, artifact hashes, or a lock file.

Each installation may therefore resolve to package versions that did not exist when the Skill was reviewed. Python package installation can execute package build logic, while installed libraries execute with the user's privileges when imported. The absence of hashes also prevents pip from confirming that only specifically reviewed distributions are installed.

This finding does not establish that the currently named packages are malicious. The risk arises from non-reproducible supply-chain resolution and the possibility of a compromised upstream account, malicious future release, dependency takeover, or unsafe incompatible update.

Attack Path

  1. An upstream package account, release pipeline, or package-index distribution is compromised, or an unsafe future version is published.
  2. The malicious or vulnerable release still satisfies the broad requirement, such as kokoro>=0.9.4.
  3. A user runs install.sh.
  4. pip resolves and downloads the newer permitted package because no exact version or approved artifact hash is required.
  5. Malicious installation logic executes during package installation, or malicious runtime logic executes when tts.py imports the dependency.
  6. The package operates with the privileges and data access of the invoking user.

Impact Assessment

A compromised dependency can execute arbitrary Python or native code as the user ...[truncated 578 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct and transitive dependency to an exact reviewed version.
  2. Generate a lock file using a controlled tool such as pip-tools, Poetry, or uv.
  3. Record hashes for every approved distribution and install with hash enforcement:
bash
python -m pip install --require-hashes -r requirements.lock
  1. Prefer reviewed binary wheels from the official package index and explicitly configure the trusted index.
  2. Test locked dependencies against supported Python and CPU platforms before publication.
  3. Update dependencies through a documented review process that includes vulnerability scanning and comparison of package ownership and release provenance.
  4. Consider disabling build isolation from untrusted source distributions by accepting only approved wheels where platform availability permits.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer unconditionally removes any existing destination path and replaces it with a symlink, with no confirmation or backup. If a user already has a skill or directory at that path, this can cause data loss or unexpected replacement of trusted content.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The conditional deletion pattern '[ -e "$DEST" ] && rm -rf "$DEST"' enables destructive filesystem changes as part of a chained operation with minimal safeguards. In this skill context, the destination lives in a user skill directory, so accidental deletion of an existing skill or directory is realistic and the lack of validation makes the installer more dangerous than the TTS function requires.

Content

Scanner excerpt · install.sh (reported line 44)May include surrounding context.

sh
# 3. register as skill (symlink)
mkdir -p "$(dirname "$DEST")"
[ -e "$DEST" ] && rm -rf "$DEST"
ln -s "$REPO_DIR" "$DEST"
echo "✓ skill installed at $DEST -> $REPO_DIR"
echo "  在 agent 里 /reset 或开新会话即可使用。"

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to tell an agent a very generic phrase ('帮我安装这个 skill') to trigger installation behavior. Broad trigger phrasing can cause unintended activation during normal conversation, potentially leading an agent to clone and execute installer commands without sufficiently explicit user consent. In this context, the installation flow includes shell execution and remote script usage, which makes accidental triggering more consequential.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash
# Debian/Ubuntu
sudo apt-get install -y espeak-ng

# 建虚拟环境并装依赖 (中文用 misaki[zh], 纯英文 misaki[en] 即可)
python3 -m venv .venv

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list contains broad, common phrases such as "tts", "speak", "narrate", and "voice synthesis" that may cause the skill to activate in contexts where the user did not specifically intend to invoke this repository. Overbroad invocation expands the attack surface and can lead to unintended package installation or code execution paths if the agent auto-runs the skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
89% confidence
Finding

The documentation instructs users to run a command with sudo to install a system package. While common for setup steps, root-level execution increases risk because users may normalize privileged commands from untrusted skills, and any modification to the install sequence or copied adjacent commands could have system-wide impact.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

首次安装 (新机器)

bash
sudo apt-get install -y espeak-ng
python3 -m venv .venv && source .venv/bin/activate
pip install torch kokoro 'misaki[zh]' numpy
python -c "from kokoro import KPipeline; KPipeline(lang_code='z', repo_id='hexgrad/Kokoro-82M')"  # 预下载 ~350MB

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The installer fetches code and dependencies from remote sources via git clone, pip install, and a model initialization that can trigger downloads, despite the skill being described as local/offline TTS. This creates a supply-chain and trust-boundary issue because installation executes or imports software not bundled with the skill and not clearly disclosed to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script performs remote clone and dependency installation without presenting a user-facing warning that it will download code, install packages, and run Python import/setup steps. This is dangerous because users may treat the skill as an offline local utility while the installer actually executes network-dependent supply-chain actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script changes system and user environment state by installing OS packages, creating a virtualenv, activating it, installing Python packages, and altering skill registration under user home directories. These actions are broader than simple runtime behavior and can unexpectedly modify a host system if run without informed consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
87% confidence
Finding

Invoking sudo apt-get install gives the installer a privileged execution path that can modify the system globally. While installing espeak-ng may be functionally legitimate for TTS, doing so from the installer increases risk if the script or upstream package sources are tampered with, especially in a one-liner install context.

Content

Scanner excerpt · install.sh (reported line 30)May include surrounding context.

sh
# 1. system dep
if command -v apt-get >/dev/null; then
  sudo apt-get install -y espeak-ng
elif command -v brew >/dev/null; then
  brew install espeak-ng
fi

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

Natural-language strings in the docstring and argument help are primarily in Chinese, which effectively forces a specific language for user-facing instructions without explicit opt-in. The file does not present a clear language choice or justify the locale restriction as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The final status message is presented only in Chinese, with no language selection or accompanying English text. This creates a language/locale policy concern because the skill forces a specific language for user-facing output without documented justification or opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

torch>=2.3 allows any future major or minor version satisfying the constraint, which makes dependency resolution non-deterministic and prevents reviewers from knowing which exact code will be installed. Given PyTorch's large attack surface and history of security advisories, leaving it broadly unpinned increases supply-chain uncertainty even if this file alone does not prove active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
torch>=2.3
kokoro>=0.9.4
misaki[zh]>=0.9.4
numpy

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The manifest does not pin a specific torch version, while the package has multiple known advisories affecting some releases. Because the resolved version is unknown, consumers cannot verify whether they will install a fixed or vulnerable build, which creates avoidable supply-chain uncertainty; this skill's local/offline TTS context does not inherently increase exploitability, but PyTorch is powerful and commonly processes model files, so version ambiguity is still risky.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

kokoro>=0.9.4 is not fully pinned, so future package releases may be pulled in without review, introducing security, behavioral, or compatibility changes. For an offline speech synthesis skill this is primarily a reproducibility and supply-chain risk, not direct evidence of malicious behavior.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
torch>=2.3
kokoro>=0.9.4
misaki[zh]>=0.9.4
numpy

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency numpy is completely unpinned, so installs may resolve to different versions over time, reducing build reproducibility and making it harder to ensure known-vulnerable releases are excluded. In a local TTS skill this is mainly a supply-chain hygiene issue rather than an immediately exploitable flaw, but it can expose users to accidental insecure or incompatible package resolution.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
torch>=2.3
kokoro>=0.9.4
misaki[zh]>=0.9.4
numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

numpy has known advisories in some versions, and because this dependency is unpinned, it is impossible to verify from the manifest whether an affected release may be installed. In this skill that mostly impacts supply-chain assurance and reproducibility rather than creating a clear direct exploit path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script writes synthesized audio directly to the user-specified output path using wave.open in write mode. While the CLI exposes the output filename, there is no confirmation prompt or explicit warning comment/docstring that an existing file at that path may be replaced.

Content

No source excerpt is available for this finding.