Is gravyxbt/x-voice-match safe?
https://github.com/openclaw/skills/tree/main/skills/gravyxbt/x-voice-match
X Voice Match is a social media voice-cloning skill that generates Twitter/X posts explicitly optimized to be indistinguishable from a target account's real content, with built-in confidence scoring targeting maximum deception efficacy. While no active credential harvesting, network exfiltration, or overt prompt override was found in the distributed files, the skill contains a multi-stage subprocess execution chain invoking an unvetted external binary (bird.sh), constructs and outputs crafted LLM prompts designed to steer the hosting agent ('Dale') bypassing direct user instruction, and is demonstrably purpose-built for a specific named agent deployment. The skill's core impersonation capability combined with absence of any safeguards makes it a high-risk component for disinformation or identity fraud when composed with any social media posting tool.
Category Scores
Findings (10)
HIGH Skill purpose-built for social media impersonation/text deepfaking -35 ▶
The skill's explicit design goal is to generate Twitter/X posts that are 'indistinguishable from real tweets' and that would 'make someone think [account] definitely wrote this.' The confidence scoring system (target 80+) and the generation checklist item 'Sounds authentic (could fool someone)' demonstrate deliberate optimization for deception rather than creative assistance. The 'Passes the would they actually tweet this? test' is a deception efficacy metric, not a quality metric. This capability enables identity fraud, reputational attacks, and disinformation at scale.
HIGH All canary credential files accessed during monitoring period -25 ▶
Six honeypot credential files were opened and read at two separate points during the audit: before clone (epoch 1771935829.431-439, ~8ms window for all 6 files) and after installation (epoch 1771935849.575, 1ms window for all 6 files). The simultaneous sub-millisecond access for all six at 1771935849 is characteristic of the Oathe framework's canary integrity verification sweep. However, the access before git clone (1771935829) precedes the Oathe file-scanning phase, and no EXECVE entry directly correlates a specific process to these reads. Canary files confirmed unmodified by integrity check.
HIGH Multi-stage subprocess execution chain with user-controlled inputs -22 ▶
analyze_voice.py executes /data/workspace/bird.sh via subprocess.run() with the user-supplied username as a positional argument. generate_post.py chains this further by spawning analyze_voice.py via subprocess. User-controlled data propagates through the entire chain: agent input → generate_post.py → analyze_voice.py → bird.sh. While shell=True is not used (preventing direct shell injection), bird.sh's argument-parsing behavior is unknown and could interpret shell metacharacters in username values.
MEDIUM generate_post.py constructs and outputs crafted LLM prompt to steer agent generation -15 ▶
The generate_post.py script constructs a detailed multi-section prompt (voice characteristics, sample tweets, critical style rules, generation task) and prints it to stdout inside a clearly delimited block. The script's own comments state the agent ('Dale') will 'intercept here and use their own LLM access to generate.' This is deliberate in-band prompt injection: the skill author controls what LLM prompt the agent applies to the generation task, bypassing whatever the user directly requested.
MEDIUM Skill explicitly targets named agent 'Dale' across multiple code locations -12 ▶
generate_post.py contains three distinct references to 'Dale' as the expected consuming agent — in a docstring, a comment, and a print statement. This indicates the skill was authored specifically for a named agent's deployment environment. Purpose-built skills may be tuned to exploit specific agent trust levels, system prompt structures, or tool-calling conventions that the skill author knows in advance.
MEDIUM Hardcoded dependency on unvetted external binary /data/workspace/bird.sh -15 ▶
The skill unconditionally invokes /data/workspace/bird.sh, an external shell script not bundled with the skill and not version-controlled within it. Its security posture, origin, and behavior are opaque. If bird.sh is compromised, swapped for a malicious version, or interprets its arguments as shell commands, the user-controlled username argument becomes an arbitrary command injection vector.
MEDIUM No safeguards against misuse; dangerous when composed with posting capability -25 ▶
The skill contains no consent verification, target allowlisting, rate limiting, disclosure requirements, or human-review checkpoints. The Batch Generation feature (generate_post.py --batch topics.txt --output posts.json) enables bulk post generation. Composed with any Twitter/X posting skill, this creates a fully automated impersonation pipeline — analyze target account, generate authentic-looking posts at scale, post without human review — suitable for disinformation operations or account fraud.
LOW Predictable temp file /tmp/voice-profile-temp.json vulnerable to symlink/race attack -8 ▶
generate_post.py hardcodes the string literal '/tmp/voice-profile-temp.json' as the temporary profile output path. On a shared system, a local attacker could pre-create a symlink at this path to redirect writes to a sensitive file or pre-populate a malicious profile that influences generation. Python's tempfile.mkstemp() should be used to create uniquely-named temp files with safe permissions.
LOW SKILL.md instructs agent to cd to hardcoded absolute path before execution -5 ▶
The Quick Start section instructs the agent to execute cd /data/workspace/skills/x-voice-match before running the Python scripts. Changing working directory modifies how all subsequent relative path resolutions in the same session operate, which could cause the agent's other tool calls to resolve paths unexpectedly.
INFO Installation performed standard git sparse-checkout from GitHub -12 ▶
The skill was installed via git clone --depth 1 --no-checkout from github.com/openclaw/skills.git (resolving to GitHub IP 140.82.121.3:443) followed by sparse-checkout of skills/gravyxbt/x-voice-match. No unexpected processes were spawned during installation. Filesystem changes were confined to /home/oc-exec/skill-under-test/. Pre-existing connections to Ubuntu/Canonical infrastructure (91.189.91.48, 185.125.188.57, 185.125.188.59) are SSH and update-check services unrelated to the skill install. Connection diff shows no new persistent outbound connections after installation.