feishu-whisper-voice

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:49 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its voice transcription purpose, but bundled scripts include unsafe defaults that can read stale local audio resources, write transcripts to a shared temp path, install packages at runtime, and persistently edit shell startup files.

Review before installing. Use an isolated environment, remove the hard-coded /tmp/openclaw scripts, avoid running helper scripts that auto-install packages, do not let the installer modify shell startup files, and treat audio/transcripts as sensitive data with explicit deletion and access controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts-/install.sh:52
• Finding: Unpinned Dependencies and Mutable Remote Source Installation## Vulnerability Details **File Location**: `scripts-/install.sh:52-54`, `scripts-/install.sh:66-79`, `scripts-/install.sh:86-100`, `scripts-/transcribe.py:31-39`, and `scripts-/transcribe_quick.py:12-19` **Vulnerability Type**: Supply-chain exposure through unpinned packages and mutable remote source code **Risk Level**: High ### Vulnerable Code `scripts-/install.sh:52-54`: ```bash # 安装核心依赖 echo "🔧 安装核心依赖..." pip install faster-whisper torch --upgrade ``` `scripts-/install.sh:66-79`: ```bash if command -v brew &> /dev/null; then # macOS Homebrew brew install whisper-cpp echo "✓ Whisper.cpp (Homebrew) 已安装" elif command -v apt-get &> /dev/null; then # Ubuntu/Debian sudo apt-get update sudo apt-get install -y whisper-cpp echo "✓ Whisper.cpp (apt) 已安装" else # 源码编译 git clone https://github.com/ggerganov/whisper.cpp cd whisper.cpp && make cd .. echo "✓ Whisper.cpp (源码编译) 已安装" fi ``` `scripts-/install.sh:86-100`: ```bash # 可选：安装高级 TTS 服务 echo "🎤 高级 TTS 服务（可选）" echo "" read -p "是否安装 Azure Cognitive Services SDK? [y/N] " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then pip install azure-cognitiveservices-speech echo "✓ Azure TTS SDK 已安装" fi read -p "是否安装 ElevenLabs CLI? [y/N] " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then pip install elevenlabs echo "✓ ElevenLabs SDK 已安装" fi ``` `scripts-/transcribe.py:31-39`: ```python except ImportError: print("❌ faster-whisper 未安装，正在尝试安装...") import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "faster-whisper"]) # 重试 from faster_whisper import WhisperModel model = WhisperModel("base", device="cpu") segments, info = model.transcribe(audio_path) ``` `scripts-/transcribe_quick.py:12-19`: ```python try: # 安装依赖（如果未安装） subprocess.run([sys.executable, "-m", ...[truncated 2105 chars]
• Remediation: ## Remediation Suggestions - Move all dependency installation into a separate, explicit setup process; transcription scripts must fail safely with installation instructions rather than invoking `pip`. - Pin every direct and transitive Python dependency to an audited version in a lock file. - Require package hashes, such as with `pip install --require-hashes`. - Pin Git dependencies to a reviewed immutable commit and verify the expected commit or signed tag before building. - Avoid `--upgrade` in reproducible installation flows. - Separate optional components into independently reviewed dependency groups. - Avoid `sudo` from the Skill installer. Provide documented administrator commands for users who explicitly choose system-wide installation. - Use an isolated virtual environment with minimal filesystem and network permissions. - Generate and retain a software bill of materials for release auditing.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts-/transcribe_local.py:48
• Finding: Sensitive Voice Transcript Written to a Predictable Shared Temporary File## Vulnerability Details **File Location**: `scripts-/transcribe_local.py:48-50` **Vulnerability Type**: Insecure temporary file handling and plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```python # 将结果写入文件供后续使用 with open("/tmp/voice_result.txt", "w", encoding="utf-8") as f: f.write(result) ``` ### Technical Analysis Transcribed voice content can contain personal, confidential, authentication, or business information. The script writes this content to the fixed path `/tmp/voice_result.txt`, which is located in a shared temporary directory. The code does not create the file with explicitly restrictive permissions, does not use an unpredictable filename, does not verify that the target is a regular file owned by the current user, and does not remove the file after use. Opening a predictable path with normal write semantics also permits a local attacker to pre-create a symbolic link or otherwise race the file operation. ### Attack Path 1. A local attacker predicts the constant path `/tmp/voice_result.txt`. 2. The attacker monitors the path or pre-creates it as a symbolic link to another file writable by the victim. 3. The victim runs `transcribe_local.py` on sensitive audio. 4. The script writes the plaintext transcript to the attacker-controlled or observable path. 5. The attacker reads the transcript or causes the transcript to overwrite another file accessible to the victim. 6. Because no cleanup is performed, the sensitive content may remain available after transcription completes. ### Impact Assessment Exploitation may disclose the complete plaintext transcript to another local user or process. A symbolic-link attack may overwrite a file that the invoking user is permitted to modify. The attack does not inherently grant privileges beyond those of the victim, but it can misuse those privileges to expose private speech content or corrupt user-owned files.
• Remediation: ## Remediation Suggestions - Keep the transcript in memory and return it directly whenever persistent output is unnecessary. - If a file is required, use `tempfile.NamedTemporaryFile` or a private per-user runtime directory. - Create the file atomically with mode `0600` and exclusive-create semantics. - Reject symbolic links and verify the resulting file is a regular file owned by the current user. - Pass the generated path directly to the authorized consumer instead of using a globally predictable name. - Delete the file in a `finally` block as soon as the consumer has finished. - Document transcript retention and obtain explicit user consent if persistence is required.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts-/transcribe_current.py:8
• Finding: Bundled Scripts Access Hard-Coded OpenClaw Audio Resources Without Current-Request Validation## Vulnerability Details **File Location**: `scripts-/transcribe_current.py:8-9`, `scripts-/transcribe_faster.py:8`, `scripts-/transcribe_latest.py:8-9`, `scripts-/transcribe_latest_v2.py:8-9`, `scripts-/transcribe_newest.py:8-9`, `scripts-/transcribe_offline.py:7`, and `scripts-/transcribe_quick.py:7` **Vulnerability Type**: Access to captured session resources without ownership or authorization validation **Risk Level**: Medium ### Vulnerable Code `scripts-/transcribe_current.py:8-9`: ```python # 最新的音频文件路径 audio_path = "/tmp/openclaw/bot-resource-1773586190608-8b5a8811-11d8-42a0-aee4-c17ea2aea956" ``` `scripts-/transcribe_faster.py:8`: ```python audio_path = "/tmp/openclaw/bot-resource-1773585421031-d57701a2-6fbd-405b-915f-9d46d7ad2ee3" ``` `scripts-/transcribe_latest.py:8-9`: ```python # 最新的音频文件路径 audio_path = "/tmp/openclaw/bot-resource-1773586420696-fbdaa3d8-bc14-4e3f-a6f0-c497f5c0a988" ``` `scripts-/transcribe_latest_v2.py:8-9`: ```python # 最新的音频文件路径 audio_path = "/tmp/openclaw/bot-resource-1773586420908-fbdaa3d8-bc14-4e3f-a6f0-c497f5c0a989" ``` `scripts-/transcribe_newest.py:8-9`: ```python # 最新的音频文件路径 audio_path = "/tmp/openclaw/bot-resource-1773586420907-d5f2d6a8-a2c6-4b0e-b5e7-0f0e5c5e5e5e" ``` `scripts-/transcribe_offline.py:7`: ```python audio_path = "/tmp/openclaw/bot-resource-1773578952536-cb087391-d1d5-4064-bd35-f40018176ec4" ``` `scripts-/transcribe_quick.py:7`: ```python audio_path = "/tmp/openclaw/bot-resource-1773578262747-a7da1d11-604d-4f80-ae2a-5ff39981f1c8" ``` The resources are subsequently transcribed and printed, as shown in `scripts-/transcribe_current.py:28-36`: ```python # 识别中文语音 segments, info = model.transcribe(audio_path, language="zh") text = "" for segment in segments: text += segment.text + " " print("="*50) print(f"✅ 识别成功！\n\n📝 内容：{text.strip()}\n") ``` ### Technical Analysis These scripts embed identifiers ...[truncated 1518 chars]
• Remediation: ## Remediation Suggestions - Remove all captured OpenClaw resource paths from the distributed package. - Require an explicit audio path or resource object associated with the current request. - Validate that the resource belongs to the current message, user, channel, and authorized session. - Resolve and normalize the path, require it to remain inside an approved private resource directory, and verify ownership and file type. - Reject stale resources and resources not created for the current processing request. - Avoid printing complete transcripts to shared logs; return them only to the authorized consumer. - Consolidate the duplicate scripts into one reviewed command-line utility with a required input argument.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts-/install.sh:105
• Finding: Installer Unnecessarily Modifies Persistent Shell Startup Files## Vulnerability Details **File Location**: `scripts-/install.sh:105-113` **Vulnerability Type**: Unsafe persistent configuration modification **Risk Level**: Medium ### Vulnerable Code ```bash # 配置环境变量提示 echo "🔑 配置环境变量（可选）" echo "" read -p "是否配置 OpenAI API Key? [y/N] " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.bashrc || true echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.zshrc || true echo "✓ OpenAI API Key 配置已添加到 shell rc 文件" fi ``` ### Technical Analysis When the user accepts the optional prompt, the installer appends a literal placeholder credential to both `.bashrc` and `.zshrc`. It does so without determining the active shell, checking for an existing variable, creating backups, or making the operation idempotent. Local Faster-Whisper transcription does not require an OpenAI API key, so persistent modification of shell startup files exceeds the minimum configuration needed for the Skill's core function. The appended assignment can override a valid key when future shells start, while repeated installation creates duplicate configuration entries. The `|| true` clauses also suppress write failures and can cause the installer to report success despite partial or failed changes. ### Attack Path 1. A user runs `install.sh` and accepts the OpenAI API key configuration prompt. 2. The installer appends `OPENAI_API_KEY="your_api_key"` to both supported startup files. 3. A future Bash or Zsh session loads the modified configuration. 4. The placeholder assignment replaces or conflicts with a legitimate environment value. 5. Applications launched from that shell use the invalid value, causing authentication failures or unintended configuration behavior. 6. Repeated runs append additional entries, making it difficult to determine which value is effective. ### Impact Assessment This issue can persistently disrupt applicatio ...[truncated 312 chars]
• Remediation: ## Remediation Suggestions - Do not modify shell startup files automatically; print scoped setup instructions instead. - Do not write placeholder credentials into persistent configuration. - Prefer a secrets manager, process-scoped environment variable, or permission-restricted application configuration file. - If automated configuration is essential, request an actual value securely without echoing it, modify only the active shell's configuration, and obtain explicit confirmation. - Detect and update existing entries idempotently rather than appending duplicates. - Create a backup before modification and report failures instead of suppressing them with `|| true`. - Keep OpenAI configuration separate from the default local Faster-Whisper installation because it is not required for local transcription.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install ffmpeg

# Ubuntu/Debian
sudo apt-get update && sudo apt-get install -y ffmpeg
```

## 使用示例

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

vices-speech
    echo "✓ Azure TTS SDK 已安装"
fi

read -p "是否安装 ElevenLabs CLI? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    pip install elevenlabs
    echo "✓ ElevenLabs SDK 已安装"
fi

echo ""

# 配置环境变量提示
echo "🔑 配置环境变量（可选）"
echo ""
read -p "是否配置 OpenAI API Key? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.bashrc || true
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.zshrc || true
    echo "✓ OpenAI API Key 配置已添加到 shell rc 文件"
fi

echo ""

# 下载 Whisper 模型（首次运行自动下载）
echo "📥 Whisper 模型说明:"
echo ""
echo "首次运行时，Whisper 会自动下载模型文件到 ~/.cache/torch/hub/"
echo ""
echo "推荐模型大小:"
echo "  - base (142MB): 通用场景，CPU 友好"
echo "  - small (466MB): 生产环境，平衡性能"
echo "  - medium (769MB): 高精度需求，需要 GPU"
echo ""

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs downloading user audio and transcribing it, but does not warn about privacy, consent, retention, or handling of potentially sensitive voice data. Voice messages can contain biometric, personal, or confidential information, so omitting data-handling guidance increases the risk of unauthorized collection, over-retention, or improper disclosure.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install ffmpeg

# Ubuntu/Debian
sudo apt-get update && sudo apt-get install -y ffmpeg
```

## 使用示例

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The script's comments, prompts, and status messages are entirely in Chinese, which imposes a specific language on users. Under the policy, this should be treated as a language/locale restriction unless the skill offers language choice or clearly documents that it is intended only for a Chinese-speaking context.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "✓ Whisper.cpp (Homebrew) 已安装"
    elif command -v apt-get &> /dev/null; then
        # Ubuntu/Debian
        sudo apt-get update
        sudo apt-get install -y whisper-cpp
        echo "✓ Whisper.cpp (apt) 已安装"
    else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

echo "✓ Whisper.cpp (Homebrew) 已安装"
    elif command -v apt-get &> /dev/null; then
        # Ubuntu/Debian
        sudo apt-get update
        sudo apt-get install -y whisper-cpp
        echo "✓ Whisper.cpp (apt) 已安装"
    else

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script appends export lines to ~/.bashrc and ~/.zshrc, which persistently modifies the user's shell configuration. Even though it asks first, it does not clearly warn that it will write to startup files, can create duplicate entries, and stores placeholder secret configuration in files many users may not expect to be changed by an installer.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The script states that model loading is 'only a check' and 'will not actually download', but constructing WhisperModel("base", device="cpu") can trigger network downloads and significant disk usage if the model is not cached. This is dangerous because an installer is making undeclared external network access and resource-consuming changes during a test step, which can surprise users and violate restricted or offline environments.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The transcription call hard-codes `language="zh"`, which enforces a specific language/locale behavior. The file does not offer a user opt-in or parameter to choose another language, and there is no documented region-specific justification for restricting recognition to Chinese.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A transcription script should not silently gain the ability to modify the host by installing packages during execution. This expands the script's privileges and attack surface beyond its stated purpose, making the skill more dangerous in agent or automation contexts where running the script may be assumed to be low risk.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The subprocess-based package installation occurs automatically after a missing import, with only a print message and no meaningful consent gate. In an automated skill context, that means executing external package-management actions on the host unexpectedly, which can violate least surprise and create supply-chain and environment-integrity risks.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("❌ faster-whisper 未安装，正在尝试安装...")
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "faster-whisper"])
        
        # 重试
        from faster_whisper import WhisperModel

• Confidence: 95% confidence
• Finding: The script invokes pip as a subprocess at runtime when an import fails, which introduces package-management and code-execution behavior into a transcription utility. Installing and executing packages from the network without explicit user approval can change the runtime environment and exposes users to supply-chain risk if package resolution or indexes are compromised.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The code hard-codes `language="zh"` for transcription, which imposes a specific language/locale behavior with no user opt-in or configurable alternative. This is a natural-language policy issue because the skill does not offer language selection and the file does not document a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The transcription call hard-codes `language="zh"`, which imposes a specific language/locale behavior on all users. The file also uses Chinese-only user-facing text, but the clearest policy issue is the unconditional locale constraint in the transcription logic with no opt-in or explanation.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The transcription call hard-codes `language="zh"`, which enforces a specific language/locale behavior. This is a natural-language policy concern because the script does not offer user opt-in or any documented rationale for restricting recognition to Chinese.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The comments and transcribe call explicitly constrain recognition to Chinese via `language="zh"`. For a code file, this is a natural-language locale policy issue because the script does not offer user opt-in or selection, and no region-specific justification is documented in the file.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The transcription call hard-codes language="zh", which imposes a specific language/locale behavior on all inputs. There is no user opt-in, alternate language selection, or justification that this tool is intentionally limited to Chinese-only use.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script writes potentially sensitive transcription content to a fixed path in /tmp without user consent, access control handling, or cleanup. On multi-user systems or shared environments, temporary files can expose private audio-derived text, be read by other processes/users depending on permissions and umask, or be overwritten/scraped unexpectedly.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script's natural-language comments and code hard-code Chinese as the transcription language via `language="zh"`. This imposes a specific language/locale behavior without offering user opt-in or documenting that the skill is intentionally limited to a Chinese-only use case.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The code comment and transcribe call explicitly constrain recognition to Chinese via language="zh". This is a natural-language locale policy issue because the script does not offer a user opt-in or configurable language selection, and no region-specific justification is documented in the file.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
    # 安装依赖（如果未安装）
    subprocess.run([sys.executable, "-m", "pip", "install", "faster-whisper", "--quiet"], check=True)
    
    from faster_whisper import WhisperModel

• Confidence: 95% confidence
• Finding: The script automatically invokes pip at runtime to install a package from an external repository, which introduces supply-chain and network-execution risk. Even though the command is not shell-injected and uses a fixed package name, it still causes unreviewed code retrieval and installation during execution, which is dangerous in an agent skill context because it expands trust to PyPI and arbitrary transitive dependencies.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The transcription call hard-codes `language="zh"`, which imposes a specific language/locale behavior on all users. This is a natural-language policy concern because the file provides no opt-in, fallback, or justification that the skill is intended only for Chinese-language audio.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill notes that WhisperModel initialization may automatically download a model, but it does not clearly warn that this triggers outbound network access to an external service. In restricted or sensitive environments, silent external downloads can violate policy, leak environment metadata, or introduce supply-chain and availability risks.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The module docstring says this is a 'skill registration script' that 'adds' the Whisper skill to the skill pool, and later output declares 'registration complete' and 'the skill has been registered'. In practice, the code only inspects local files/directories and enumerates skills; it does not add or modify any registry state.

Static analysis

No suspicious patterns detected.