Security audit

Kokoro Tts Amx

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local text-to-speech skill, but installation can change the local system and download dependencies or models.

Install only if you are comfortable with system package installation, PyPI dependency installation, and a Hugging Face model download/cache. Prefer cloning and reviewing a pinned commit over the curl-to-bash path, and back up any existing kokoro-tts-amx skill directory before running install.sh.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The installer performs multiple network-dependent actions: it may clone a repository from a user-supplied REPO_URL, install Python dependencies from requirements.txt, and trigger a model download from Hugging Face via KPipeline. While this can be normal for installation, it contradicts the 'local/offline TTS' framing and increases supply-chain risk because remote code and model artifacts are fetched and executed/trusted during install.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script installs a system package using apt-get with sudo or via brew, which changes the host system outside the isolated skill directory. For a TTS skill this may be functionally justified because espeak-ng can be a runtime dependency, but privileged modification without prior warning expands impact if the script or package source is compromised.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill description promises fully local/offline TTS, but the code constructs the pipeline using a Hugging Face repo identifier, which may trigger network access and remote model retrieval at runtime unless the model is already cached. This creates a trust-boundary mismatch: users may run the skill in sensitive environments believing no external communication occurs, exposing metadata, downloading unpinned artifacts, or failing in offline-only contexts.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger list includes broad terms like 'tts', 'speak', and '朗读', which are common in normal conversation and may cause unintended invocation. In an agent environment with shell/package installation capability, accidental activation can lead to unnecessary command execution, package installation prompts, or network downloads that the user did not intend.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The installer unconditionally removes any existing path at the destination with rm -rf before creating a symlink. If that path contains an existing skill, local modifications, or unexpected data, it will be deleted without confirmation, creating a destructive local integrity risk.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.