Security audit

Local Llama TTS

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small local text-to-speech wrapper with disclosed behavior, though users should be careful about unverified model downloads and a shell argument handling bug.

Reasonable to install if you trust the model sources and use it locally. Prefer pinned downloads with published SHA-256 checksums, and avoid passing untrusted speaker filenames until the script uses an argument array and validates option values.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tts-local.sh:29
Finding: Argument Injection Through Unquoted Speaker Parameter Expansion
Content: View full analysis
Remediation: View remediation
&2 usage } OUTPUT="$2" shift 2 ;; -s|--speaker) [[ $# -ge 2 ]] || { echo "Error: $1 requires a value." >&2 usage } SPEAKER_ARGS=(--tts-speaker-file "$2") shift 2 ;; -t|--temp) [[ $# -ge 2 ]] || { echo "Error: $1 requires a value." >&2 usage } TEMP="$2" shift 2 ;; -h|--help) usage ;; --) shift TEXT="$*" break ;; -*) echo "Error: unknown option: $1" >&2 usage ;; *) TEXT="$1" shift ;; esac done llama-tts \ -m "$MODEL" \ -mv "$VOCODER" \ -p "$TEXT" \ -o "$OUTPUT" \ --temp "$TEMP" \ --repeat-penalty "$REP_PENALTY" \ --repeat-last-n "$REP_LAST_N" \ --top-k "$TOP_K" \ --top-p "$TOP_P" \ --min-p "$MIN_P" \ "${SPEAKER_ARGS[@]}" ``` Additionally: - Validate that the speaker file exists, is a regular file, and is readable. - Validate output paths according to the intended trust boundary. - Validate temperature as a numeric value within the supported range. - Reject unknown options rather than treating them as text. - Use `set -euo pipefail` where compatible to make parsing and execution failures explicit. ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:32
Finding: Model and Vocoder Downloads Are Not Pinned or Integrity-Verified
Content: View full analysis
Remediation: View remediation
OuteTTS-1.0-0.6B-Q4_K_M.gguf' | sha256sum --check - echo ' WavTokenizer-Large-75-Q4_0.gguf' | sha256sum --check - ``` The placeholders must be replaced with hashes calculated from reviewed, trusted copies of the exact pinned artifacts. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.