Trust Assessment
telnyx-tts received a trust score of 86/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Output file path traversal vulnerability, User text sent to third-party API.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Output file path traversal vulnerability The skill uses the user-provided `--output` argument directly in `open()` without sanitization or validation. An attacker can use path traversal sequences (e.g., `../../`) to write the generated audio file to arbitrary locations on the filesystem, potentially overwriting sensitive files or writing to directories outside the intended scope. This grants excessive write permissions to the skill. Sanitize the `output_path` argument to prevent path traversal. Ensure the path is normalized and restricted to an allowed directory (e.g., `/tmp/` or a skill-specific sandbox). For example, use `os.path.basename()` if only a filename is expected, or `pathlib.Path(output_path).resolve()` and then check if it's within an allowed base directory. | LLM | scripts/telnyx-tts.py:100 | |
| INFO | User text sent to third-party API The skill's core functionality involves sending user-provided text to the Telnyx Text-to-Speech API. While this is the intended behavior, users should be aware that any sensitive information included in the input text will be transmitted to Telnyx. This is a data flow characteristic rather than a direct vulnerability of the skill's code, but it's important for privacy considerations. Inform users that input text is sent to Telnyx. Consider adding a disclaimer or a mechanism for users to confirm data sharing for sensitive inputs. | LLM | scripts/telnyx-tts.py:49 |
Scan History
Embed Code
[](https://skillshield.io/report/6a6eec1004cb44ac)
Powered by SkillShield