Qwen3-TTS VoiceDesign

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:36 PM UTC
• Version: 1.0.0

Overview

This TTS skill is mostly purpose-aligned, but it exposes a costly unauthenticated server by default and includes unsafe startup/configuration patterns that need review before installation.

Install only if you are comfortable reviewing and hardening the scripts first. Bind the server to 127.0.0.1 unless you intentionally expose it, add authentication and request limits for remote use, avoid the elevated scheduled-task example, do not run setup/start as administrator, and replace unsafe .env sourcing and shell-built JSON before using it with untrusted inputs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T06 · System Persistence

Error

• Location: SKILL.md:136
• Finding: Highest-Privilege Logon Persistence Through a Scheduled Task<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:136-145` **Vulnerability Type**: Privileged scheduled-task persistence **Risk Level**: High ### Vulnerable Code ```bat # Auto-restart (Windows — scheduled task + guard script) # Create tts_guard.bat: # @echo off # :loop # python tts_server.py # timeout /t 10 # goto loop # Register: schtasks /create /tn "TTS-Guard" /tr "tts_guard.bat" /sc onlogon /rl highest ``` ### Technical Analysis The documentation instructs users to create a scheduled task that launches at every logon with `/rl highest`. The referenced guard script then repeatedly starts `tts_server.py` indefinitely. Automatic startup may be useful for a server, but elevated execution is not required for a TTS process listening on port 8881. The task also uses relative paths for both the batch file and Python script. Consequently, its effective behavior depends on the task's working directory, executable search path, and the write permissions protecting those files. This persistence is not installed automatically by the supplied setup script, but it becomes active if a user follows the documented instructions. It exceeds the minimum privileges required by the declared TTS functionality. ### Attack Path 1. A user creates `tts_guard.bat` and registers the documented scheduled task. 2. The task is configured to run at logon with the highest available privilege level. 3. An attacker who can replace the guard script, `tts_server.py`, or a resolved `python` executable modifies the content that the task invokes. 4. At the next logon, the scheduled task executes the modified content with elevated privileges. 5. The guard loop restarts the payload whenever it exits, providing recurring execution. ### Impact Assessment Successful exploitation can provide repeated elevated code execution across user sessions. The exact privilege obtained depends on the account registering the task and Windows task configuration, but it can exceed the pr ...[truncated 150 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `/rl highest` recommendation; the TTS server should run as a standard, unprivileged user. - Default to foreground execution or an explicitly enabled user-level startup mechanism. - If a scheduled task is required, use absolute paths for the interpreter, guard script, server script, and working directory. - Apply restrictive ACLs so unprivileged users cannot modify any task target. - Avoid an unconditional infinite restart loop; use bounded retries, backoff, health checks, and failure logging. - Document removal and disablement commands alongside any optional persistence instructions. - Prefer a dedicated low-privilege service account with no administrative permissions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:135
• Finding: Arbitrary Shell Execution Through Sourced Environment Configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:135-139` **Vulnerability Type**: Unsafe configuration-file evaluation **Risk Level**: High ### Vulnerable Code ```bash # Load .env if exists if [[ -f "$INSTALL_DIR/.env" ]]; then set -a source "$INSTALL_DIR/.env" set +a fi ``` ### Technical Analysis The `source` command executes a file as Bash code. A `.env` file is normally expected to contain inert key-value configuration, but this implementation permits command substitutions, shell functions, redirections, and arbitrary commands. The setup process creates the file only if it does not already exist. Therefore, an existing malicious `.env`, or one modified after installation, will be executed whenever the user runs the `start` action. The code performs no ownership, permission, syntax, or variable-name validation before sourcing it. ### Attack Path 1. An attacker gains write access to the installation directory or `.env` file, or convinces the user to deploy an installation directory containing a prepared `.env`. 2. The attacker adds shell code, such as a command substitution or a standalone command, to `.env`. 3. The user runs `bash scripts/setup.sh start <install_dir>`. 4. `source "$INSTALL_DIR/.env"` evaluates the attacker's content. 5. The injected command executes with all permissions of the user starting the server. ### Impact Assessment Exploitation results in arbitrary command execution under the server operator's account. If the script is started by an administrator or from the documented elevated scheduled task, the commands may execute with administrative privileges. This can expose local files, modify the installation, establish persistence, or compromise other resources accessible to that account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not use `source` to parse `.env` files. - Parse only an explicit allowlist such as `TTS_SEED`, `TTS_INSTRUCT`, `TTS_MODEL_PATH`, `TTS_PORT`, and `TTS_HOST`. - Reject lines containing command substitutions, shell operators, unsupported variable names, or malformed values. - Validate `TTS_PORT` as an integer in the valid TCP port range and validate `TTS_HOST` as an expected address. - Verify that the configuration file is owned by the intended service account and is not group- or world-writable. - Pass validated configuration directly to the Python process rather than evaluating it as shell syntax. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/say.sh:32
• Finding: Python Code Injection Through the TTS_FORMAT Environment Variable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/say.sh:32` **Vulnerability Type**: Command injection through generated Python source **Risk Level**: High ### Vulnerable Code ```bash BODY=$(python3 -c "import json,sys; print(json.dumps({'text': sys.argv[1], 'format': '$TTS_FORMAT'}))" "$TEXT") ``` ### Technical Analysis `TTS_FORMAT` is inserted directly into the source text passed to `python3 -c`. It is not supplied as data through `sys.argv` and is not validated against the documented `mp3` and `wav` values. A crafted value containing a quote and valid Python statements can terminate the string literal and introduce additional Python expressions. Bash does not need to reinterpret the malicious value for the attack to succeed because the final expanded string itself becomes executable Python source. ### Attack Path 1. An attacker controls or influences the environment used to launch `say.sh`. 2. The attacker sets `TTS_FORMAT` to a value that closes the Python string and inserts Python code. 3. The user invokes `scripts/say.sh`. 4. Bash expands the malicious value into the argument supplied to `python3 -c`. 5. Python parses and executes the injected code with the invoking user's privileges. ### Impact Assessment Successful exploitation provides arbitrary local code execution as the user running the client script. The injected Python process can read or alter files, launch subprocesses, access environment variables, or make network requests using that user's permissions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Pass all values as positional arguments rather than embedding them in Python source: ```bash case "$TTS_FORMAT" in mp3|wav) ;; *) echo "Unsupported TTS_FORMAT: $TTS_FORMAT" >&2 exit 1 ;; esac BODY=$(python3 -c ' import json import sys print(json.dumps({"text": sys.argv[1], "format": sys.argv[2]})) ' "$TEXT" "$TTS_FORMAT") ``` Additionally, use a fixed interpreter path or a controlled virtual environment where appropriate, and document that only `mp3` and `wav` are accepted. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/tts_server.py:39
• Finding: Unauthenticated TTS Generation Service Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/tts_server.py:39-142` **Vulnerability Type**: Missing authentication and resource controls **Risk Level**: High ### Vulnerable Code ```python PORT = int(os.environ.get("TTS_PORT", "8881")) HOST = os.environ.get("TTS_HOST", "0.0.0.0") ``` ```python @app.post("/v1/audio/speech") async def openai_tts(req: OpenAITTSRequest): return await generate(req.input, DEFAULT_SEED, None, req.response_format) @app.post("/tts") async def tts(req: TTSRequest): return await generate(req.text, req.seed, req.instruct, req.format) @app.get("/tts") async def tts_get(text: str, seed: int = DEFAULT_SEED, format: str = "mp3"): return await generate(text, seed, None, format) ``` ```python if __name__ == "__main__": load_model() uvicorn.run(app, host=HOST, port=PORT, log_level="info") ``` ### Technical Analysis The service defaults to `0.0.0.0`, exposing it on every available network interface. All generation endpoints are accessible without authentication or authorization. There are no explicit limits on text or instruction length, request rate, concurrent inference jobs, or generation duration. TTS inference is computationally expensive and consumes GPU memory and processing time. An attacker who can reach TCP port 8881 can repeatedly invoke generation or submit oversized input. The GET endpoint also places input into URLs, which can cause text to be recorded in browser history, proxy logs, and access logs. ### Attack Path 1. The operator starts the server using its default `TTS_HOST`. 2. Port 8881 becomes reachable from other hosts permitted by local routing and firewall rules. 3. A remote attacker discovers the service and sends repeated or large requests to `/tts` or `/v1/audio/speech`. 4. Each accepted request invokes GPU-backed model generation. 5. Concurrent or sustained requests consume GPU, CPU, memory, and worker availability, preventing legitimate use or crashing the process. ### Impa ...[truncated 464 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Change the default bind address to `127.0.0.1`. - Require explicit operator configuration before binding to a non-loopback interface. - Add API-key or mutually authenticated reverse-proxy protection for remote deployments. - Enforce strict maximum lengths for `text` and `instruct`. - Add per-client rate limits, request timeouts, bounded queues, and inference concurrency limits. - Restrict accepted output formats and seed ranges. - Disable the GET generation endpoint in production so sensitive text is not placed in URLs. - Use host firewall rules and network segmentation to limit access. - Run the service under a dedicated unprivileged account. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:63
• Finding: Unpinned Dependencies and Mutable Model Downloads<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:63-89` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Install dependencies echo "Installing dependencies..." pip install --upgrade pip pip install qwen-tts soundfile pydub uvicorn fastapi numpy # Install PyTorch with CUDA (if not already) if ! python -c "import torch; assert torch.cuda.is_available()" 2>/dev/null; then echo "Installing PyTorch with CUDA..." pip install torch --index-url https://download.pytorch.org/whl/cu128 fi # Download model (via modelscope for China, huggingface otherwise) echo "" echo "Downloading VoiceDesign model (~3.5GB)..." echo "Trying ModelScope first (faster in China)..." if pip install modelscope 2>/dev/null && python -c " from modelscope import snapshot_download path = snapshot_download('Qwen/Qwen3-TTS-12Hz-1.7B-VoiceDesign') print(f'Model downloaded to: {path}') " 2>/dev/null; then ``` ```bash python -c " from qwen_tts import Qwen3TTSModel m = Qwen3TTSModel.from_pretrained('Qwen/Qwen3-TTS-12Hz-1.7B-VoiceDesign') print('Model downloaded via HuggingFace ✓') del m " ``` ### Technical Analysis The installer retrieves package names without fixed versions or cryptographic hashes. It also upgrades `pip` to the latest available release and downloads a model by a mutable repository identifier rather than a reviewed immutable revision. Python package installation can execute build backends and other installation-time code. Runtime imports also execute package initialization code. As a result, the effective code installed by this Skill can change between installations without any modification to the audited repository. No evidence of a deliberately malicious package or source was identified. The vulnerability is the absence of controls that would detect compromised, replaced, or unexpectedly incompatible upstream releases. ### Attack Path 1. An upstream package account, distributi ...[truncated 811 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct and transitive dependency to a reviewed version. - Generate a lockfile and require hashes for downloaded Python artifacts. - Avoid unconditionally upgrading `pip`. - Pin the model to an immutable reviewed revision or commit. - Verify model files against published checksums or signed manifests. - Use only explicitly trusted package indexes and repository endpoints. - Build and test dependencies in an isolated environment before production deployment. - Add automated vulnerability and provenance scanning for packages and model artifacts. - Run installation without administrative privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/batch_seeds.sh:35
• Finding: JSON Injection in Batch TTS Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/batch_seeds.sh:35-39` **Vulnerability Type**: Unsafe manual JSON construction **Risk Level**: Medium ### Vulnerable Code ```bash http_code=$(curl -s -o "$out" -w "%{http_code}" \ -X POST "http://${HOST}:${PORT}/tts" \ -H "Content-Type: application/json" \ -d "{\"text\": \"${TEXT}\", \"seed\": ${seed}, \"format\": \"mp3\"}") ``` ### Technical Analysis The script inserts `TEXT` and `seed` directly into JSON syntax. It does not JSON-escape quotes, backslashes, or control characters in the text, and it does not verify that each seed is an integer. A crafted text value can close the JSON string and append additional properties. A crafted seed can insert arbitrary JSON tokens because it is placed in an unquoted numeric position. Depending on duplicate-key handling and schema validation, this can alter request fields or make the request malformed. The values are expanded inside an already parsed shell word, so this particular construction does not directly execute shell metacharacters from `TEXT` or `seed`. The confirmed issue is request-data injection and reliability loss, not shell command injection. ### Attack Path 1. An attacker supplies or influences the text or seed arguments passed to `batch_seeds.sh`. 2. The script interpolates those values into the JSON body without encoding or validation. 3. The crafted value terminates its expected JSON context and introduces additional syntax or fields. 4. The server receives an altered or malformed request. 5. The request can change accepted TTS parameters, trigger errors, or interfere with batch operation. ### Impact Assessment The attacker can manipulate the JSON request sent to the configured TTS service and can cause failed or unintended generation. If the script is pointed at a shared remote service, this can consume service resources or submit content different from what the operator intended. Based on the reviewed code, this issue alone d ...[truncated 42 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Validate every seed using a strict integer expression before use. - Construct the body with a JSON serializer instead of string interpolation. - For example, pass text and seed as arguments to Python: ```bash [[ "$seed" =~ ^-?[0-9]+$ ]] || { echo "Invalid seed: $seed" >&2 exit 1 } BODY=$(python3 -c ' import json import sys print(json.dumps({ "text": sys.argv[1], "seed": int(sys.argv[2]), "format": "mp3" })) ' "$TEXT" "$seed") http_code=$(curl -s -o "$out" -w "%{http_code}" \ -X POST "http://${HOST}:${PORT}/tts" \ -H "Content-Type: application/json" \ --data-binary "$BODY") ``` - Add `curl --fail-with-body`, connection timeouts, total request timeouts, and explicit handling for non-success HTTP status codes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Credential Access

High

• Category: Privilege Escalation

Content

# One-click setup (Python 3.10+ and CUDA GPU required)
bash scripts/setup.sh ./my-tts

# Configure voice in .env
echo 'TTS_SEED=201' >> ./my-tts/.env
echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# One-click setup (Python 3.10+ and CUDA GPU required)
bash scripts/setup.sh ./my-tts

# Configure voice in .env
echo 'TTS_SEED=201' >> ./my-tts/.env
echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# One-click setup (Python 3.10+ and CUDA GPU required)
bash scripts/setup.sh ./my-tts

# Configure voice in .env
echo 'TTS_SEED=201' >> ./my-tts/.env
echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# One-click setup (Python 3.10+ and CUDA GPU required)
bash scripts/setup.sh ./my-tts

# Configure voice in .env
echo 'TTS_SEED=201' >> ./my-tts/.env
echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# One-click setup (Python 3.10+ and CUDA GPU required)
bash scripts/setup.sh ./my-tts

# Configure voice in .env
echo 'TTS_SEED=201' >> ./my-tts/.env
echo 'TTS_INSTRUCT=Your voice description here' >> ./my-tts/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true

    # Create .env template
    if [[ ! -f "$INSTALL_DIR/.env" ]]; then
        cat > "$INSTALL_DIR/.env" << 'ENVEOF'
# Qwen3-TTS Configuration
# Uncomment and edit as needed

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true

    # Create .env template
    if [[ ! -f "$INSTALL_DIR/.env" ]]; then
        cat > "$INSTALL_DIR/.env" << 'ENVEOF'
# Qwen3-TTS Configuration
# Uncomment and edit as needed

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true

    # Create .env template
    if [[ ! -f "$INSTALL_DIR/.env" ]]; then
        cat > "$INSTALL_DIR/.env" << 'ENVEOF'
# Qwen3-TTS Configuration
# Uncomment and edit as needed

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

cp "$SCRIPT_DIR/batch_seeds.sh" "$INSTALL_DIR/batch_seeds.sh" 2>/dev/null || true

    # Create .env template
    if [[ ! -f "$INSTALL_DIR/.env" ]]; then
        cat > "$INSTALL_DIR/.env" << 'ENVEOF'
# Qwen3-TTS Configuration
# Uncomment and edit as needed

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documents shell commands, environment-variable configuration, and server deployment, but it does not declare any explicit tool scope or permissions. That increases the chance an agent may invoke shell or env capabilities without clear operator consent or policy review, especially because the skill includes setup, networking, and background-process management steps.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation encourages use of a network-accessible TTS service over HTTP and references binding the server to 0.0.0.0, but it does not warn that submitted text and generated audio may traverse the network unencrypted or be exposed to other hosts. In agent contexts, users may send sensitive prompts or private content to the service without realizing it is remote and potentially reachable by others.

External Transmission

Medium

• Category: Data Exfiltration

Content

### OpenAI-Compatible

```bash
curl -X POST $TTS_URL/v1/audio/speech \
  -H "Content-Type: application/json" \
  -d '{"input": "Hello!"}' -o speech.mp3
```

• Confidence: 90% confidence
• Finding: The skill explicitly sends user-provided text to an HTTP endpoint via curl, which is an external data transmission path. In this context that is expected functionality, but it still matters because agents may forward sensitive user content to a remote server without authentication, encryption, or clear disclosure.

Session Persistence

Medium

• Category: Rogue Agent

Content

python tts_server.py

# Start (background, Linux/macOS)
nohup python tts_server.py > server.log 2>&1 &

# Auto-restart (Windows — scheduled task + guard script)
# Create tts_guard.bat:

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

out="$OUT_DIR/seed_${seed}.mp3"
  printf "Seed %-10s → " "$seed"
  t0=$(date +%s)
  http_code=$(curl -s -o "$out" -w "%{http_code}" \
    -X POST "http://${HOST}:${PORT}/tts" \
    -H "Content-Type: application/json" \
    -d "{\"text\": \"${TEXT}\", \"seed\": ${seed}, \"format\": \"mp3\"}")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This shell script sends the user-supplied TEXT value in an HTTP POST request to a TTS service, which is a network operation that transmits user data. While the script logs that generation is happening, it does not disclose that the text content is being sent over the network to a service endpoint, so users are not warned about the privacy implication of the transmission.

External Transmission

Medium

• Category: Data Exfiltration

Content

AUTO_PLAY=0
fi

curl -s -o "$OUTPUT" \
    -X POST "${TTS_URL}/tts" \
    -H "Content-Type: application/json" \
    -d "$BODY"

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script performs an HTTP POST that transmits the user's input text to a TTS server, which can affect privacy if the text contains sensitive content. Although the header comments mention a server URL, there is no clear runtime disclosure, confirmation, or explicit warning that input text is being sent over the network.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The .env template and test command embed Chinese-only sample content such as the persona text and `text=你好`, which presents a language-specific default in natural-language guidance. Because the script does not state that the skill is China- or Chinese-specific, this can violate language/locale policy by implicitly forcing a specific language without user opt-in.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The startup path uses `source "$INSTALL_DIR/.env"`, which executes the file as shell code rather than parsing it as data. If an attacker can modify the local `.env` file or trick a user into using a tainted install directory, arbitrary commands will run with the privileges of the user starting the service.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The examples and repeated guidance for `TTS_INSTRUCT` are exclusively in Chinese, including the main voice description example and descriptor lists, which implies a specific language/locale expectation for users. The file does not explicitly state that this is optional, user-selected, or limited by model behavior, so it can be read as a language-policy constraint without opt-in.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The example usage and default TEXT both force Chinese output text as the built-in default behavior. This may violate language/locale policy expectations because the script does not present this as a user choice or document why a Chinese-only default is required.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The only demonstrated usage examples are Chinese text inputs, which can imply a fixed language expectation without any stated user choice or opt-in. For natural-language policy review, this is a minor locale/language constraint signal that is not explicitly justified or presented as optional.

Static analysis

No suspicious patterns detected.