Voice (Edge TTS)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:00 PM UTC
• Version: 1.10.0

Overview

This voice skill does provide text-to-speech, but its security claims do not match the code and normal inputs can reach unsafe local command and file operations.

Review before installing. The skill should be fixed to avoid shell command strings, use spawn or execFile with argument arrays everywhere, validate all caller options, restrict output and cleanup to a private skill-owned directory, remove or tightly gate the runtime install action, and clearly warn that text is sent to an external TTS service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:24

Finding

Shell Command Injection Through Text-to-Speech Parameters

Content

View full analysis

Remediation

View remediation

{ const child = spawn('edge-tts', args, { shell: false }); child.once('error', reject); child.once('close', code => { if (code === 0) resolve(); else reject(new Error(`edge-tts exited with code ${code}`)); }); }); ``` 3. Enforce an explicit whitelist for supported voices in every action, not only in the streaming action. 4. Validate `rate`, `volume`, and `pitch` with strict, anchored formats and documented numeric ranges. 5. Generate output paths internally and apply the path controls described in the separate filesystem finding. 6. Add automated regression tests containing shell metacharacters, command substitutions, quotes, newlines, and option-like input. 7. Avoid attempting to fix this solely through shell escaping; bypassing the shell is the appropriate security boundary. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:24

Finding

Unrestricted Output Paths and Overbroad Temporary-File Deletion

Content

View full analysis

Remediation

View remediation

.mp3`. 7. Validate `hoursOld` as a finite number within a nonnegative, bounded range. Do not use `options?.hoursOld || 1`, because it obscures some invalid values. 8. Use `lstat()` and protect against symbolic-link and time-of-check/time-of-use issues if the directory can be modified by other users. 9. Add tests for absolute paths, `../` traversal, symbolic links, negative ages, nonnumeric ages, and unrelated files in the cleanup directory. ]]>

T08 · Insecure Dependencies

Warning

• Location: index.js:185

Finding

Runtime Installation of an Unpinned Dependency and Use of a Noncanonical Package Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins the skill to ws 8.19.0, and the provided advisories indicate this version is affected by uninitialized memory disclosure and a memory-exhaustion denial of service condition. Because this is a voice skill that depends on edge-tts, a WebSocket library is plausibly used in normal operation, so a remotely reachable crash or data leak in dependency code is a real supply-chain risk rather than a purely theoretical issue.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

Install ffmpeg (for streaming)

Windows: https://github.com/GyanD/codexffmpeg/releases

macOS: brew install ffmpeg

Linux: sudo apt install ffmpeg

text

## Usage

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Install ffmpeg (for streaming)

Windows: https://github.com/GyanD/codexffmpeg/releases

macOS: brew install ffmpeg

Linux: sudo apt install ffmpeg

text

## Usage

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sets the default voice to zh-CN-XiaoxiaoNeural, which makes the skill produce Chinese-language speech unless the caller explicitly overrides it. This is a natural-language locale choice imposed by default rather than offered as an opt-in or neutral selection.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill launches local system players and a Python subprocess, giving it the ability to execute host-side programs beyond pure TTS generation. While spawn is used more safely than raw shell execution in these paths, this still broadens the attack surface and enables side effects on the local machine, including arbitrary file playback and invocation of external interpreters/binaries present on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill exposes an install action that runs pip3 install edge-tts via a shell command at runtime, which expands the skill's capabilities beyond text-to-speech into package management. Allowing an externally invocable skill to install software increases supply-chain and environment-modification risk, especially if the host runs with elevated privileges or unrestricted network access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

In the stream action, the code falls back to zh-CN-XiaoxiaoNeural when no voice is provided or when an unsupported voice is requested. This again enforces a specific language/locale by default instead of giving the user a clear choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Natural-language policy checks apply to all file types. The file description, default text, and default voice are all fixed to Chinese/zh-CN, which imposes a specific language/locale choice unless the user overrides parameters manually; there is no explicit user-facing opt-in or documented justification for this locale restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script sends arbitrary provided text to the external edge-tts service, which can expose sensitive or private user content over the network without any warning, consent, or data-handling notice. In a voice helper context, users may reasonably assume local processing, so silent transmission increases privacy risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · stream_speak.py (reported line 28)May include surrounding context.

python

try:
        # 启动 ffplay 进程
        ffplay_process = subprocess.Popen(
            [FFMPEG_PATH, "-nodisp", "-autoexit", "-i", "pipe:0", "-"],
            stdin=subprocess.PIPE,
            stdout=subprocess.DEVNULL,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The usage example hard-codes Chinese text ('你好，我是小九') as the demonstrated output language, which can be interpreted as steering the skill toward a specific language without any user choice or explanation. The file does not indicate that language is configurable or that this is merely one optional example.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README sets the default voice to zh-CN-XiaoxiaoNeural, which imposes a locale-specific default behavior. While multiple voices are listed elsewhere, the document does not explicitly state that language/locale is user-selectable or ask for user opt-in before using the Chinese default.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file's comments and example code present this as a usable example of a Voice skill, but module.exports = VoiceSkill; exports an identifier that is only defined inside the example function scope and is not available at module scope. This contradicts the apparent intent of the file as a working example or exportable module.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range (^1.0.0), which permits automatic installation of newer compatible releases rather than a single vetted version. This increases supply-chain risk because a compromised or malicious upstream release could be pulled into the skill without explicit review; in a voice/audio skill, that could affect speech generation, outbound requests, or local playback behavior.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"author": "zhaov1976",
  "license": "MIT",
  "dependencies": {
    "edge-tts": "^1.0.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:111