Security audit
Security checks for vulnerabilities and agentic risk
The skill’s daily reading workflow fits its purpose, with manageable caveats around online narration and separately supplied dependencies.
Narration sends its script to Microsoft’s online speech service, as documented by [edge-tts](https://github.com/rany2/edge-tts); keep private information out of it or set NO_TTS=1. Pin the speech dependency and review the separately supplied archive helpers before use. The package also needs the missing book text. Inspection did not substantiate the scanner’s language-mismatch, excessive-permission, or credential-flow concerns.
Progress management is consistent with the description, but explicitly selecting English conflicts with the advertised Chinese presentation. The description permits an English source excerpt, not an English overall language setting. The script implementation is not supplied, so the precise effect of this setting cannot be verified.
Without declared permissions the skill's intent is opaque and cannot be validated.
The narration workflow transmits the reading script to an external speech service without clearly telling the user that the text leaves the local environment. The normal payload is generated commentary on public-domain literature, substantially limiting confidentiality impact, but naming edge-tts does not adequately disclose the data transfer.
The fallback invokes an unpinned Python package through uvx, potentially downloading and executing a changing dependency with the agent's permissions. This is a supply-chain exposure, although edge-tts is a CLI package rather than an MCP server.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save(data):
PROGRESS_FILE.parent.mkdir(parents=True, exist_ok=True)
PROGRESS_FILE.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8")
def book_body(book):
The script executes edge-tts through uvx without specifying a reviewed version, leaving executed code dependent on package resolution and future upstream releases. A compromised resolved dependency could execute with the script's permissions; this is a package supply-chain issue, not an unpinned MCP server.
Passing the input file to edge-tts sends its text to an external speech service, while the script provides no explicit privacy notice or consent gate. Intended inputs are non-sensitive literary narration, reducing the normal impact, but any private text included in that file would also be transmitted.