T06 · System Persistence
Error
- Location
SKILL.md:136- Finding
Highest-Privilege Logon Persistence Through a Scheduled Task
- Content
View full analysis
- Remediation
View remediation
Security audit
Qwen3-TTS VoiceDesign
Security checks for vulnerabilities and agentic risk
Overview
This TTS skill is mostly purpose-aligned, but it exposes a costly unauthenticated server by default and includes unsafe startup/configuration patterns that need review before installation.
Install only if you are comfortable reviewing and hardening the scripts first. Bind the server to 127.0.0.1 unless you intentionally expose it, add authentication and request limits for remote use, avoid the elevated scheduled-task example, do not run setup/start as administrator, and replace unsafe .env sourcing and shell-built JSON before using it with untrusted inputs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:135- Finding
Arbitrary Shell Execution Through Sourced Environment Configuration
- Content
View full analysis
`. 4. `source "$INSTALL_DIR/.env"` evaluates the attacker's content. 5. The injected command executes with all permissions of the user starting the server. ### Impact Assessment Exploitation results in arbitrary command execution under the server operator's account. If the script is started by an administrator or from the documented elevated scheduled task, the commands may execute with administrative privileges. This can expose local files, modify the installation, establish persistence, or compromise other resources accessible to that account. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/say.sh:32- Finding
Python Code Injection Through the TTS_FORMAT Environment Variable
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 ;; esac BODY=$(python3 -c ' import json import sys print(json.dumps({"text": sys.argv[1], "format": sys.argv[2]})) ' "$TEXT" "$TTS_FORMAT") ``` Additionally, use a fixed interpreter path or a controlled virtual environment where appropriate, and document that only `mp3` and `wav` are accepted. ]]>
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/tts_server.py:39- Finding
Unauthenticated TTS Generation Service Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/setup.sh:63- Finding
Unpinned Dependencies and Mutable Model Downloads
- Content
View full analysis
/dev/null; then echo "Installing PyTorch with CUDA..." pip install torch --index-url https://download.pytorch.org/whl/cu128 fi # Download model (via modelscope for China, huggingface otherwise) echo "" echo "Downloading VoiceDesign model (~3.5GB)..." echo "Trying ModelScope first (faster in China)..." if pip install modelscope 2>/dev/null && python -c " from modelscope import snapshot_download path = snapshot_download('Qwen/Qwen3-TTS-12Hz-1.7B-VoiceDesign') print(f'Model downloaded to: {path}') " 2>/dev/null; then ``` ```bash python -c " from qwen_tts import Qwen3TTSModel m = Qwen3TTSModel.from_pretrained('Qwen/Qwen3-TTS-12Hz-1.7B-VoiceDesign') print('Model downloaded via HuggingFace ✓') del m " ``` ### Technical Analysis The installer retrieves package names without fixed versions or cryptographic hashes. It also upgrades `pip` to the latest available release and downloads a model by a mutable repository identifier rather than a reviewed immutable revision. Python package installation can execute build backends and other installation-time code. Runtime imports also execute package initialization code. As a result, the effective code installed by this Skill can change between installations without any modification to the audited repository. No evidence of a deliberately malicious package or source was identified. The vulnerability is the absence of controls that would detect compromised, replaced, or unexpectedly incompatible upstream releases. ### Attack Path 1. An upstream package account, distributi ...[truncated 811 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/batch_seeds.sh:35- Finding
JSON Injection in Batch TTS Requests
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 } BODY=$(python3 -c ' import json import sys print(json.dumps({ "text": sys.argv[1], "seed": int(sys.argv[2]), "format": "mp3" })) ' "$TEXT" "$seed") http_code=$(curl -s -o "$out" -w "%{http_code}" \ -X POST "http://${HOST}:${PORT}/tts" \ -H "Content-Type: application/json" \ --data-binary "$BODY") ``` - Add `curl --fail-with-body`, connection timeouts, total request timeouts, and explicit handling for non-success HTTP status codes. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # One-click setup (Python 3.10+ and CUDA GPU required) bash scripts/setup.sh ./my-tts # Configure voice in .env echo 'TTS_SEED=201' >> ./my-tts/.env echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # One-click setup (Python 3.10+ and CUDA GPU required) bash scripts/setup.sh ./my-tts # Configure voice in .env echo 'TTS_SEED=201' >> ./my-tts/.env echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # One-click setup (Python 3.10+ and CUDA GPU required) bash scripts/setup.sh ./my-tts # Configure voice in .env echo 'TTS_SEED=201' >> ./my-tts/.env echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # One-click setup (Python 3.10+ and CUDA GPU required) bash scripts/setup.sh ./my-tts # Configure voice in .env echo 'TTS_SEED=201' >> ./my-tts/.env echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # One-click setup (Python 3.10+ and CUDA GPU required) bash scripts/setup.sh ./my-tts # Configure voice in .env echo 'TTS_SEED=201' >> ./my-tts/.env echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true # Create .env template if [[ ! -f "$INSTALL_DIR/.env" ]]; then cat > "$INSTALL_DIR/.env" << 'ENVEOF' # Qwen3-TTS Configuration # Uncomment and edit as needed
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true # Create .env template if [[ ! -f "$INSTALL_DIR/.env" ]]; then cat > "$INSTALL_DIR/.env" << 'ENVEOF' # Qwen3-TTS Configuration # Uncomment and edit as needed
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true # Create .env template if [[ ! -f "$INSTALL_DIR/.env" ]]; then cat > "$INSTALL_DIR/.env" << 'ENVEOF' # Qwen3-TTS Configuration # Uncomment and edit as needed
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true # Create .env template if [[ ! -f "$INSTALL_DIR/.env" ]]; then cat > "$INSTALL_DIR/.env" << 'ENVEOF' # Qwen3-TTS Configuration # Uncomment and edit as needed
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents shell commands, environment-variable configuration, and server deployment, but it does not declare any explicit tool scope or permissions. That increases the chance an agent may invoke shell or env capabilities without clear operator consent or policy review, especially because the skill includes setup, networking, and background-process management steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation encourages use of a network-accessible TTS service over HTTP and references binding the server to 0.0.0.0, but it does not warn that submitted text and generated audio may traverse the network unencrypted or be exposed to other hosts. In agent contexts, users may send sensitive prompts or private content to the service without realizing it is remote and potentially reachable by others.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The skill explicitly sends user-provided text to an HTTP endpoint via curl, which is an external data transmission path. In this context that is expected functionality, but it still matters because agents may forward sensitive user content to a remote server without authentication, encryption, or clear disclosure.
- Content
OpenAI-Compatible
bash curl -X POST $TTS_URL/v1/audio/speech \ -H "Content-Type: application/json" \ -d '{"input": "Hello!"}' -o speech.mp3
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md python tts_server.py # Start (background, Linux/macOS) nohup python tts_server.py > server.log 2>&1 & # Auto-restart (Windows — scheduled task + guard script) # Create tts_guard.bat:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh out="$OUT_DIR/seed_${seed}.mp3" printf "Seed %-10s → " "$seed" t0=$(date +%s) http_code=$(curl -s -o "$out" -w "%{http_code}" \ -X POST "http://${HOST}:${PORT}/tts" \ -H "Content-Type: application/json" \ -d "{\"text\": \"${TEXT}\", \"seed\": ${seed}, \"format\": \"mp3\"}")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This shell script sends the user-supplied TEXT value in an HTTP POST request to a TTS service, which is a network operation that transmits user data. While the script logs that generation is happening, it does not disclose that the text content is being sent over the network to a service endpoint, so users are not warned about the privacy implication of the transmission.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh AUTO_PLAY=0 fi curl -s -o "$OUTPUT" \ -X POST "${TTS_URL}/tts" \ -H "Content-Type: application/json" \ -d "$BODY"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script performs an HTTP POST that transmits the user's input text to a TTS server, which can affect privacy if the text contains sensitive content. Although the header comments mention a server URL, there is no clear runtime disclosure, confirmation, or explicit warning that input text is being sent over the network.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The .env template and test command embed Chinese-only sample content such as the persona text and
text=你好, which presents a language-specific default in natural-language guidance. Because the script does not state that the skill is China- or Chinese-specific, this can violate language/locale policy by implicitly forcing a specific language without user opt-in.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The startup path uses
source "$INSTALL_DIR/.env", which executes the file as shell code rather than parsing it as data. If an attacker can modify the local.envfile or trick a user into using a tainted install directory, arbitrary commands will run with the privileges of the user starting the service.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The examples and repeated guidance for
TTS_INSTRUCTare exclusively in Chinese, including the main voice description example and descriptor lists, which implies a specific language/locale expectation for users. The file does not explicitly state that this is optional, user-selected, or limited by model behavior, so it can be read as a language-policy constraint without opt-in.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The example usage and default TEXT both force Chinese output text as the built-in default behavior. This may violate language/locale policy expectations because the script does not present this as a user choice or document why a Chinese-only default is required.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The only demonstrated usage examples are Chinese text inputs, which can imply a fixed language expectation without any stated user choice or opt-in. For natural-language policy review, this is a minor locale/language constraint signal that is not explicitly justified or presented as optional.
- Content
Static analysis
No suspicious patterns detected.