Security audit

Lux Tts

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly a local TTS integration, but its install guidance and file-handling expose more local write and install authority than users are clearly warned about.

Review before installing. Run it only in a dedicated low-privilege environment, inspect any referenced deploy/download scripts before use, avoid ExecutionPolicy Bypass unless you understand the risk, pin dependencies, and do not expose the voice-import or output-path interfaces to untrusted callers. Treat the current implementation as partly simulated TTS, not guaranteed real LuxTTS synthesis.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: lux_tts_tool.py:108
Finding: Caller-Controlled Voice Name Allows Path Traversal and Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lux_tts_ready.py:62
Finding: Nonexistent Voice Path Causes Caller-Controlled File Creation
Content: View full analysis
Dict[str, Any]: print(f"📝 Encoding audio prompt: {audio_path}") # Check whether the file exists if not os.path.exists(audio_path): # Create test audio self._create_test_audio(audio_path) return { "prompt": "simulated_encoding", "rms": rms, "audio_path": audio_path, "duration": 3.0, "sample_rate": 48000 } ``` ```python def _create_test_audio(self, audio_path: str): sample_rate = 48000 duration = 3.0 t = np.linspace(0, duration, int(sample_rate * duration), False) # Create a 440 Hz test tone audio = 0.3 * np.sin(2 * np.pi * 440 * t) # Save sf.write(audio_path, audio, sample_rate) print(f"Created test audio: {audio_path}") ``` ```python # Use the default voice file if not voice_file: voice_file = "D:/lux-tts/voices/default.wav" if not os.path.exists(voice_file): self.model._create_test_audio(voice_file) # Encode prompt encoded = self.model.encode_prompt(voice_file, rms=0.01) ``` ### Technical Analysis The public `generate()` method passes a caller-supplied `voice_file` to `encode_prompt()`. When that path does not exist, the implementation treats it as an output destination and creates a synthetic WAV file there. A TTS reference-audio parameter should normally be read-only. Creating a file at a missing input path is not necessary for speech generation and unexpectedly exposes the process's filesystem write privileges. The path is not canonicalized or restricted to `D:/lux-tts/voices`. Any destination with an existing writable parent may be selected. There is also a check-then-write interval between `os.path.e ...[truncated 1349 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lux_tts_fixed.py:72
Finding: Predictable Shared Temporary Filename Enables Collision and Symlink Attacks
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: INSTALL_GUIDE.md:26
Finding: Installation Instructions Use Unpinned Dependencies Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly recommends using powershell -ExecutionPolicy Bypass -File deploy.ps1 to circumvent PowerShell's script execution protections, but does not warn that this disables a defense meant to prevent untrusted script execution. In an installation guide that already asks users to run local scripts and batch files, this increases the chance a user will execute tampered or unsafe code with reduced safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented fallback pattern silently sends text to a cloud TTS provider when local generation fails, but it does not warn that user content may leave the local environment. In a skill whose stated value is privacy-preserving local TTS, this creates a meaningful confidentiality risk because users may assume sensitive text is always processed locally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documents a forceful cache deletion command (Remove-Item ... -Recurse -Force) without any warning, scope limitation, or confirmation step. Even though this is documentation rather than executable code, users may copy and run it directly, causing unintended data loss if the cache path is misconfigured or expanded beyond what the user expects.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generate() docstring says it converts input text into speech, but the body explicitly labels the work as a simulated generation process and creates a fixed-frequency sine wave based only on text length. This is an active contradiction between the documented intent and the actual behavior, not merely an omitted implementation detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The top-level docstring says this is a fully usable LuxTTS simulation with the same API and seamless replacement path, and the class docstring repeats that claim. However, the code returns a hardcoded 'simulated_encoding' in encode_prompt and generates sinusoidal waveform tones in generate_speech rather than performing genuine prompt encoding or speech synthesis, so the documentation overstates what the code actually does.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file's user-facing documentation and CLI/status/test messages are written exclusively in Chinese, and the built-in test phrase is also hardcoded in Chinese. This imposes a specific language/locale experience without offering the user a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CLI writes decoded audio bytes to a user-specified output path without any path restrictions, confirmation, or safety checks. In an agent or automation context, this can overwrite arbitrary files accessible to the process, enabling destructive file clobbering or placement of attacker-controlled content in sensitive locations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The top-level documentation says this file integrates LuxTTS into the tool system, which implies text-to-speech functionality. However, the implementation includes add_voice(), which copies a user-supplied file path into the configured voices directory, adding local file ingestion and filesystem modification behavior not described by the documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains user-facing descriptions, help text, status messages, and errors entirely in Chinese, starting with the module docstring and continuing throughout the CLI interface. Under the policy rule, forcing a specific language without opt-in is a natural-language locale violation because users are not offered any language choice and no region-specific justification is stated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation says this is a simple test script for LuxTTS, which implies validating the LuxTTS functionality itself. However, lines L44-L59 create a separate 440 Hz sine wave using NumPy and write it to a hard-coded filesystem location, an action not actually testing LuxTTS output and extending beyond the stated purpose of the script.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code contains user-facing and instructional natural-language content in Chinese, such as the module docstring and comments, without any indication that the skill is intentionally locale-specific or that users can opt into another language. That can violate the language/locale policy because it implicitly forces a specific language for understanding or maintenance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function returns a result structure containing file_path as though it refers to generated output, yet the file is removed immediately before the return. This contradicts the apparent contract of the returned data and can mislead callers about what artifact exists after generation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The method is documented as performing audio prompt encoding with parameters matching the real LuxTTS API. In practice, if the supplied path does not exist, it silently creates a test WAV file at that path and then returns a simulated encoding object, which contradicts the stated intent of merely encoding the caller's prompt audio.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file contains user-facing natural-language content in Chinese in the module docstring and function docstring/comments, with no indication that another language is available. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.