Security audit

Voice Mode

Security checks for vulnerabilities and agentic risk

Overview

This skill has a legitimate voice-reply purpose, but it hard-codes a Telegram bot token and recipient and can automatically forward AI replies to that fixed chat.

Do not install this as-is unless you fully control the embedded Telegram bot and Chat ID and understand that enabled replies may be converted to audio and sent there. Before use, remove the hard-coded token and recipient, rotate the exposed token, require per-chat configuration and confirmation, avoid shell-string interpolation for TTS text, and pin dependencies in a controlled environment.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:36
Finding: Hard-Coded Telegram Bot Credential
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:72
Finding: Fixed Telegram Recipient Can Cause Unauthorized Disclosure of Reply Content
Content: View full analysis
200 else None ) ``` ### Technical Analysis The documented send operation uses a hard-coded Telegram Chat ID rather than deriving the destination from the authenticated active conversation. Consequently, installing or invoking this Skill in another environment can route generated reply audio to the account represented by the embedded identifier. The daemon accepts a Chat ID through its command line and checks that received messages belong to that chat. It then transmits generated audio to the same configured identifier. For text longer than 200 characters, it additionally sends the first 200 characters as a plaintext caption. Although Telegram transmission is necessary for the declared voice-response feature, a globally fixed recipient is not necessary and violates least-privilege and destination-binding principles. The daemon also logs up to 60 characters of processed reply text. This creates a secondary local disclosure channel through application logs. ### Attack Path 1. A user or administrator installs the Skill without replacing or validating the embedded Chat ID. 2. Voice mode is enabled. 3. The agent generates a reply containing private, operational, or otherwise sensitive information. 4. The Skill converts that reply i ...[truncated 958 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:53
Finding: PowerShell Command Injection Through TTS Reply Text
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:115
Finding: Unpinned Runtime Installation of Third-Party TTS Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the model to automatically convert and retransmit its prior reply content as audio, which can include sensitive data derived from user inputs or system context. Because this occurs automatically once enabled, it creates a persistent exfiltration channel in natural-language form to an external service.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill hard-codes a Bot Token, Chat ID, and automatic voice-sending workflow to a fixed Telegram target, creating a direct data-disclosure mechanism to a specific external account. In skill context, this is more dangerous because the destination is predetermined and opaque to the user, strongly suggesting intentional exfiltration rather than normal user-directed messaging.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill performs file writes, may install software, and sends outbound Telegram messages, yet it does not require clear user-facing disclosure or confirmation about these side effects. Hidden state changes and outbound communications can surprise users and lead to unintended disclosure or system modification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs the agent to install a package via shell command at runtime without explicit user approval, provenance checks, or environment constraints. Allowing a skill to trigger package installation expands the attack surface, can modify the host system unexpectedly, and normalizes execution of network-fetching commands from untrusted skill content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The daemon automatically monitors bot messages and forwards their content into a TTS pipeline and back to Telegram without any per-message consent, warning, or data classification check. In this context, messages may contain secrets, personal data, or sensitive operational output, so the automation creates an avoidable privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code hard-codes the voice locale to "zh-CN-XiaoyiNeural", and the surrounding natural-language description is entirely Chinese with no indication that users can opt into a different language or locale. This creates a locale policy issue because the skill enforces a specific language setting rather than offering user choice or documenting a justified regional constraint.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · voice_daemon.py (reported line 73)May include surrounding context.
python
def edge_tts(text, output_path): try: result = subprocess.run( ["edge-tts", "--voice", VOICE, "--text", text, "--write-media", str(output_path)], capture_output=True, text=True, timeout=60 )

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill hard-codes zh-CN-XiaoyiNeural as the required voice and presents it as a fixed parameter, which forces a specific language/locale behavior. There is no user opt-in, alternative locale selection, or documented reason that this skill must be Chinese-only.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The note says the voice content should be exactly the text that was just sent, with no extra content. However, the exception table later says text over 200 characters should be truncated before generating speech, which means the voice content would no longer match the just-sent text.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.