The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The script scripts/say.sh constructs a PowerShell command string by concatenating variables like VOICE and TEXT directly into a script block. While it attempts to escape double quotes using sed 's/"/"/g', it fails to sanitize other PowerShell control characters such as backticks (`` ``), semicolons (;), or subexpression syntax ($()). An attacker providing a payload like "); Start-Process calc; # would successfully break out of the Speak() method and execute arbitrary code on the Windows host.
[Indirect Prompt Injection] (HIGH): As a TTS skill, this tool is designed to process text which often originates from untrusted external sources (e.g., website content, emails, or chat messages). Because the skill lacks a security boundary or robust sanitization (Category 8), any malicious instructions embedded in processed data can trigger the Command Execution vulnerability mentioned above.
Ingestion points: The TEXT argument in scripts/say.sh (derived from agent context).
Boundary markers: None. The input is interpolated directly into a string template.
Capability inventory: Direct execution of powershell.exe with access to the host Windows environment.
Sanitization: Insufficient; only escapes double quotes, leaving multiple other injection vectors open.

windows-tts