Zyt tts voice clone

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 0.4.0

Overview

The skill is a disclosed Chanjing voice-cloning TTS integration that handles credentials and sends voice/text data to Chanjing as expected for its purpose.

Install only if you are comfortable giving the skill access to a Chanjing app_id and secret_key and sending reference voice audio URLs plus synthesis text to Chanjing's API. Keep the credential file private, use a dedicated Chanjing credential if possible, and avoid using sensitive or unauthorized voice samples.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill explicitly reads credentials from ~/.chanjing/credentials.json, demonstrating access to sensitive local secrets. In this context, credential access is expected for API authentication, but it is still security-sensitive because the skill lacks strong scoping and relies on a plaintext local secret store.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

## How to Use This Skill

**前置条件（本地配置与鉴权）**：本 Skill 自己包含本地配置和鉴权流程，不依赖其他 skill 的运行时脚本。  
默认读取 `~/.chanjing/credentials.json`；若设置 `CHANJING_CONFIG_DIR`，则读取 `$CHANJING_CONFIG_DIR/credentials.json`。  
API 固定使用 `https://open-api.chanjing.cc`。  
当本地缺少 AK/SK 或 AK/SK 无效时，脚本默认返回登录引导信息，不自动打开浏览器。  
如需本地自动开页，可显式设置：`CHANJING_AUTO_OPEN_LOGIN=1`。登录页：`https://www.chanjing.cc/openapi/login`。

Credential Access

High

• Category: Privilege Escalation
• Confidence: 76% confidence

Finding

Mention of an access token is not inherently malicious, but it does indicate session-bearing secret material is obtained and reused across requests. In combination with local credential storage and undeclared tool scope, token handling becomes security-relevant because leaked tokens could enable unauthorized API operations until expiry.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

5. Poll the Query Speech Generation Task Status API until the result is success
6. When the task status is complete, use the corresponding url in API response to download the generated audio file

### Get Access Token API

从 `~/.chanjing/credentials.json` 读取 `app_id` 和 `secret_key`，若无有效 Token 则调用：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The documented token acquisition flow instructs reading app_id and secret_key from a local credentials file, which is sensitive credential handling. If the skill or surrounding agent environment is compromised, these secrets could be exposed and used to access the third-party account.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Get Access Token API

从 ~/.chanjing/credentials.json 读取 app_id 和 secret_key，若无有效 Token 则调用：

http

POST /open/v1/access_token

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The request example shows direct use of locally stored app_id and secret_key, reinforcing a pattern of handling long-lived secrets in a way that may be copied into scripts, logs, or debugging output. This increases the blast radius if the local environment or skill execution context is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

json

{
  "app_id": "<从 credentials.json 读取>",
  "secret_key": "<从 credentials.json 读取>"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The explicit inclusion of secret_key in a local JSON-driven request flow indicates sensitive secret material is expected to be available to scripts at runtime. That is dangerous because any overly broad tool access, shell execution, or local compromise could exfiltrate the key and enable unauthorized API use.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

json

{
  "app_id": "<从 credentials.json 读取>",
  "secret_key": "<从 credentials.json 读取>"
}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 1)May include surrounding context.

python

# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 10)May include surrounding context.

python

# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 17)May include surrounding context.

python

# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 26)May include surrounding context.

python

# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_auth.py (reported line 27)May include surrounding context.

python

# 鉴权：从 CONFIG_DIR/credentials.json 读取 AK/SK
# 实现：AK/SK 校验、Token 校验与刷新；默认不自动打开浏览器，仅返回登录引导信息
import json
import os

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents capabilities to read local credentials, write local config/token data, invoke shell scripts, and make outbound network requests, but it declares no explicit tool scope or permissions. This increases the chance an agent executes broader-than-expected actions without user visibility or policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-provided reference voice audio URLs and synthesis text to a third-party API, but the user-facing description does not warn about this data transfer. Users may unknowingly upload sensitive biometric voice data or confidential text to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs storage of app_id and secret_key in plaintext JSON under the user's home directory, but does not warn users about the security implications. Plaintext credential storage increases the risk of local credential theft by other processes, users, backups, or accidental disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

You should use utf-8 to encode and decode text throughout this task.

1. Obtain an access\_token, which is required for subsequent requests
2. Call the Create Voice API, which accepts a url to an audio file as reference voice
3. Poll the Query Voice API until the result is success; keep the voice ID
4. Call the Create Speech Generation Task API, using the voice ID, record the `task_id`
5. Poll the Query Speech Generation Task Status API until the result is success

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 10, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/_auth.py (reported line 56)May include surrounding context.

python

os.chmod(CONFIG_DIR, 0o700)
    except Exception:
        pass
    with open(CONFIG_FILE, "w", encoding="utf-8") as f:
        json.dump(data, f, indent=2, ensure_ascii=False)
    try:
        os.chmod(CONFIG_FILE, 0o600)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code reads app_id/secret_key from a local credentials file and sends them in an HTTP POST request to obtain an access token. While there are internal comments about authentication, there is no confirmation prompt or explicit user-facing warning in the executable flow that local credentials will be transmitted to a remote API and cached token data will be written back to disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Several operational instructions are presented only in Chinese while the rest of the skill description is in English. This creates an implicit language constraint without user opt-in or documented justification, which fits the language/locale policy concern described in SQP-3.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comments and user-facing error/help messages in this file are written only in Chinese, which imposes a language choice without offering opt-in or fallback. The file does not document that the skill is intentionally limited to Chinese-speaking users or provide a locale selection mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.