ClawHub
Back to skill

Security audit

Voice

Security checks for vulnerabilities and agentic risk

Overview

The skill has a real text-to-speech purpose, but its implementation allows unsafe shell execution and overbroad file operations that need review before installation.

Review this skill carefully before installing. It appears intended for text-to-speech, but only use it in a sandboxed environment, avoid sensitive text, do not invoke the install action unless you trust the dependency source, and restrict or fix shell execution, output paths, playback paths, and cleanup behavior before broader use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:21
Finding

Shell Command Injection Through Text-to-Speech Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
index.js:91
Finding

PowerShell Code Injection Through Audio File Paths

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
index.js:43
Finding

Unrestricted Output Path Allows Writes Outside Skill Temporary Storage

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:132
Finding

Cleanup Action Can Delete Unrelated Files from a Shared Temporary Directory

Content
View full analysis
Remediation
View remediation
.mp3`. - Require `hoursOld` to be a finite number within a safe nonnegative range: ```javascript if (!Number.isFinite(hoursOld) || hoursOld < 0 || hoursOld > MAX_RETENTION_HOURS) { throw new Error('Invalid cleanup age'); } ``` - Use `lstat` and reject symbolic links before deletion. - Handle concurrent file changes safely so that a file cannot be replaced between inspection and deletion. - Consider using per-invocation temporary directories and deleting them after use. ]]>

T08 · Insecure Dependencies

Warning
Location
index.js:183
Finding

Runtime Installation of Unpinned and Inconsistently Declared Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill can execute 'pip3 install edge-tts' from within the agent via the 'install' action, giving it the ability to modify the host environment beyond normal TTS behavior. Runtime package installation is dangerous because it invokes a shell command, changes system state, may pull unpinned code from the network, and can be abused in environments where skills should not self-install software.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documentation describes TTS features but does not clearly disclose that user-provided text is transmitted to Microsoft's Edge TTS service for processing. This creates a real privacy and data-handling risk because users may submit sensitive content under the assumption processing is local, causing unintended third-party disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file is documented as an example script for using the Voice skill, with comments showing demonstration calls and an optional invocation. However, L50 exports VoiceSkill, which is never defined in this file; the only in-scope binding is skill, while VoiceSkill exists only inside the example function. This contradicts the file's apparent documented role as a standalone example and indicates behavior inconsistent with the comments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The automatic dependency installation path runs a shell command with no confirmation, warning, or policy gate, so a caller can cause immediate environment modification simply by invoking the action. Even if the package is legitimate, silent execution of installation commands increases the risk of unintended software changes, supply-chain exposure, and misuse by downstream agents or prompts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes a generic 'play' action that will play any local file path provided by the caller, which is broader than the documented text-to-speech purpose. In an agent setting, this expands capability scope and could be abused to access or interact with arbitrary local media paths, trigger unwanted playback, or serve as a stepping stone for probing local filesystem state via existence/error behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L12 says the skill 'defaults to using Chinese voice zh-CN-XiaoxiaoNeural'. This is a natural-language locale policy concern because it imposes a specific language/locale by default, and this changelog entry does not indicate that users can choose or opt in to that locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file documents actions that save audio to disk (tts) and remove files (cleanup), but it does not include any explicit warning that these operations write to and delete local files. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The configuration specifies zh-CN-XiaoxiaoNeural as the default voice, which imposes a specific language/locale preference in natural-language behavior. SQP-3 applies because the file does not indicate that users are asked to choose a locale or that the Chinese default is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The markdown explains how to run the cleanup action and notes file retention timing, but it does not plainly warn that invoking cleanup will delete files from the temp directory. Since file deletion is a potentially destructive operation, the skill description should make that consequence explicit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The options section specifies zh-CN-XiaoxiaoNeural as the default voice, which imposes a specific language/locale by default. The file does not state that users can choose their preferred language before use or justify why Chinese should be the default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The default voice is hard-coded to zh-CN-XiaoxiaoNeural, which imposes a specific language/locale choice automatically. The file does not indicate that this locale restriction is required or that users are given an explicit opt-in before the default is applied.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency version is specified with a caret range (^1.0.0), which allows newer minor and patch releases to be installed automatically. This creates a supply-chain risk because future upstream changes could introduce malicious code, vulnerable transitive dependencies, or breaking behavior without the skill author explicitly reviewing and pinning the update.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json
"author": "zhaov1976",
  "license": "MIT",
  "dependencies": {
    "edge-tts": "^1.0.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
index.js:111