Text to Speech (TTS) · Speech Synthesis

• Outcome: Review
• Latest audit: Nov 9, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill is marked suspicious because scanners report an audio transcription and upload feature outside its stated text-to-speech purpose; the overall confidence is medium.

Consider avoiding installation unless you need the reported transcription feature and are comfortable with local audio being uploaded for remote processing. The scanners also report a partial analysis with unresolved references, so this verdict is not a complete assurance about the artifact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The core TTS functionality matches the description, including submitting text, selecting actors or reference audio, choosing output formats, and passing generation settings. However, the recognize command introduces a distinct audio-to-text capability and local audio upload that the TTS description does not disclose. This is not merely subtitle creation accompanying synthesized speech: it accepts a separate local file and submits it for recognition. Several advertised workflow features are also absent from the supplied chunk. Ordinary API authentication, task polling, and output downloads are supporting implementation details and are not independently treated as mismatches.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 40)May include surrounding context.

python

self.timeout = timeout
        self.opener = urllib.request.build_opener(NoRedirect())

    def request(self, method, path, payload=None, content_type=None, key=None, timeout=None):
        headers = {'Authorization': 'Bearer ' + self.key, 'Accept': 'application/json'}
        if content_type:
            headers['Content-Type'] = content_type

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 59)May include surrounding context.

python

except (urllib.error.URLError, TimeoutError, OSError, ValueError) as exc:
            raise ClientError({'error': {'code': 'request_failed', 'message': 'API request failed; submission outcome may be unknown. Reuse the same idempotency key for the same payload.'}}) from None

    def task(self, task_id, timeout=None):
        return self.request('GET', '/tasks/' + urllib.parse.quote(task_id, safe=''), timeout=timeout)

    def capabilities(self):

The client exposes a standalone audio-transcription capability outside the declared text-to-speech scope.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The manifest describes synthesizing speech from text and producing subtitles alongside generated narration. However, the recognize command (L160–L162) accepts a local file, uploads its contents to /subtitles/recognitions, and submits an independently priced recognition task. Transcribing user-supplied audio is a separate capability, not a necessary implementation detail of generating speech or timing subtitles from the source text.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voiceover.py (reported line 163)May include surrounding context.

python

cmd += [flag, str(p[k])]
    for t in p.get("tags", []):
        cmd += ["--tag=" + t]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0 or not os.path.exists(out_path):
        sys.stderr.write(r.stdout + r.stderr)
        raise ScriptError("generate failed for: %s... Re-run the same command to resume; the same idempotency key "

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 203)May include surrounding context.

python

raise ValueError('--reference-text requires --reference-audio-url.')
                payload = {'text': args.text if args.text is not None else args.text_file.read_text(encoding='utf-8')}
                for field in ('actor_id', 'reference_audio_url', 'reference_text', 'model', 'format', 'speed', 'tags', 'language'):
                    value = getattr(args, field)
                    if value is not None:
                        payload[field] = value
                result = client.request('POST', '/audio/generations', json.dumps(payload).encode(), 'application/json', submission_key)