feishu-whisper-voice

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:49 AM UTC
• Version: 1.0.3

Overview

The skill mostly matches its voice transcription purpose, but bundled scripts include unsafe defaults that can read stale local audio resources, write transcripts to a shared temp path, install packages at runtime, and persistently edit shell startup files.

Review before installing. Use an isolated environment, remove the hard-coded /tmp/openclaw scripts, avoid running helper scripts that auto-install packages, do not let the installer modify shell startup files, and treat audio/transcripts as sensitive data with explicit deletion and access controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts-/install.sh:52

Finding

Unpinned Dependencies and Mutable Remote Source Installation

Content

View full analysis

Vulnerability Details

File Location: scripts-/install.sh:52-54, scripts-/install.sh:66-79, scripts-/install.sh:86-100, scripts-/transcribe.py:31-39, and scripts-/transcribe_quick.py:12-19
Vulnerability Type: Supply-chain exposure through unpinned packages and mutable remote source code
Risk Level: High

Vulnerable Code

scripts-/install.sh:52-54:

bash

# 安装核心依赖
echo "🔧 安装核心依赖..."
pip install faster-whisper torch --upgrade

scripts-/install.sh:66-79:

bash

if command -v brew &> /dev/null; then
    # macOS Homebrew
    brew install whisper-cpp
    echo "✓ Whisper.cpp (Homebrew) 已安装"
elif command -v apt-get &> /dev/null; then
    # Ubuntu/Debian
    sudo apt-get update
    sudo apt-get install -y whisper-cpp
    echo "✓ Whisper.cpp (apt) 已安装"
else
    # 源码编译
    git clone https://github.com/ggerganov/whisper.cpp
    cd whisper.cpp && make
    cd ..
    echo "✓ Whisper.cpp (源码编译) 已安装"
fi

scripts-/install.sh:86-100:

bash

# 可选：安装高级 TTS 服务
echo "🎤 高级 TTS 服务（可选）"
echo ""
read -p "是否安装 Azure Cognitive Services SDK? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    pip install azure-cognitiveservices-speech
    echo "✓ Azure TTS SDK 已安装"
fi

read -p "是否安装 ElevenLabs CLI? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    pip install elevenlabs
    echo "✓ ElevenLabs SDK 已安装"
fi

scripts-/transcribe.py:31-39:

python

except ImportError:
    print("❌ faster-whisper 未安装，正在尝试安装...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "faster-whisper"])

    # 重试
    from faster_whisper import WhisperModel
    model = WhisperModel("base", device="cpu")
    segments, info = model.transcribe(audio_path)

scripts-/transcribe_quick.py:12-19:

python

try:
    # 安装依赖（如果未安装）
    subprocess.run([sys.executable, "-m", 
...[truncated 2105 chars]

Remediation

View remediation

Remediation Suggestions

• Move all dependency installation into a separate, explicit setup process; transcription scripts must fail safely with installation instructions rather than invoking pip.
• Pin every direct and transitive Python dependency to an audited version in a lock file.
• Require package hashes, such as with pip install --require-hashes.
• Pin Git dependencies to a reviewed immutable commit and verify the expected commit or signed tag before building.
• Avoid --upgrade in reproducible installation flows.
• Separate optional components into independently reviewed dependency groups.
• Avoid sudo from the Skill installer. Provide documented administrator commands for users who explicitly choose system-wide installation.
• Use an isolated virtual environment with minimal filesystem and network permissions.
• Generate and retain a software bill of materials for release auditing.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts-/transcribe_local.py:48

Finding

Sensitive Voice Transcript Written to a Predictable Shared Temporary File

Content

View full analysis

Vulnerability Details

File Location: scripts-/transcribe_local.py:48-50
Vulnerability Type: Insecure temporary file handling and plaintext sensitive-data exposure
Risk Level: High

Vulnerable Code

python

# 将结果写入文件供后续使用
with open("/tmp/voice_result.txt", "w", encoding="utf-8") as f:
    f.write(result)

Technical Analysis

Transcribed voice content can contain personal, confidential, authentication, or business information. The script writes this content to the fixed path /tmp/voice_result.txt, which is located in a shared temporary directory.

The code does not create the file with explicitly restrictive permissions, does not use an unpredictable filename, does not verify that the target is a regular file owned by the current user, and does not remove the file after use. Opening a predictable path with normal write semantics also permits a local attacker to pre-create a symbolic link or otherwise race the file operation.

Attack Path

1. A local attacker predicts the constant path /tmp/voice_result.txt.
2. The attacker monitors the path or pre-creates it as a symbolic link to another file writable by the victim.
3. The victim runs transcribe_local.py on sensitive audio.
4. The script writes the plaintext transcript to the attacker-controlled or observable path.
5. The attacker reads the transcript or causes the transcript to overwrite another file accessible to the victim.
6. Because no cleanup is performed, the sensitive content may remain available after transcription completes.

Impact Assessment

Exploitation may disclose the complete plaintext transcript to another local user or process. A symbolic-link attack may overwrite a file that the invoking user is permitted to modify. The attack does not inherently grant privileges beyond those of the victim, but it can misuse those privileges to expose private speech content or corrupt user-owned files.

Remediation

View remediation

Remediation Suggestions

• Keep the transcript in memory and return it directly whenever persistent output is unnecessary.
• If a file is required, use tempfile.NamedTemporaryFile or a private per-user runtime directory.
• Create the file atomically with mode 0600 and exclusive-create semantics.
• Reject symbolic links and verify the resulting file is a regular file owned by the current user.
• Pass the generated path directly to the authorized consumer instead of using a globally predictable name.
• Delete the file in a finally block as soon as the consumer has finished.
• Document transcript retention and obtain explicit user consent if persistence is required.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts-/transcribe_current.py:8

Finding

Bundled Scripts Access Hard-Coded OpenClaw Audio Resources Without Current-Request Validation

Content

View full analysis

Vulnerability Details

File Location: scripts-/transcribe_current.py:8-9, scripts-/transcribe_faster.py:8, scripts-/transcribe_latest.py:8-9, scripts-/transcribe_latest_v2.py:8-9, scripts-/transcribe_newest.py:8-9, scripts-/transcribe_offline.py:7, and scripts-/transcribe_quick.py:7
Vulnerability Type: Access to captured session resources without ownership or authorization validation
Risk Level: Medium

Vulnerable Code

scripts-/transcribe_current.py:8-9:

python

# 最新的音频文件路径
audio_path = "/tmp/openclaw/bot-resource-1773586190608-8b5a8811-11d8-42a0-aee4-c17ea2aea956"

scripts-/transcribe_faster.py:8:

python

audio_path = "/tmp/openclaw/bot-resource-1773585421031-d57701a2-6fbd-405b-915f-9d46d7ad2ee3"

scripts-/transcribe_latest.py:8-9:

python

# 最新的音频文件路径
audio_path = "/tmp/openclaw/bot-resource-1773586420696-fbdaa3d8-bc14-4e3f-a6f0-c497f5c0a988"

scripts-/transcribe_latest_v2.py:8-9:

python

# 最新的音频文件路径
audio_path = "/tmp/openclaw/bot-resource-1773586420908-fbdaa3d8-bc14-4e3f-a6f0-c497f5c0a989"

scripts-/transcribe_newest.py:8-9:

python

# 最新的音频文件路径
audio_path = "/tmp/openclaw/bot-resource-1773586420907-d5f2d6a8-a2c6-4b0e-b5e7-0f0e5c5e5e5e"

scripts-/transcribe_offline.py:7:

python

audio_path = "/tmp/openclaw/bot-resource-1773578952536-cb087391-d1d5-4064-bd35-f40018176ec4"

scripts-/transcribe_quick.py:7:

python

audio_path = "/tmp/openclaw/bot-resource-1773578262747-a7da1d11-604d-4f80-ae2a-5ff39981f1c8"

The resources are subsequently transcribed and printed, as shown in scripts-/transcribe_current.py:28-36:

python

# 识别中文语音
segments, info = model.transcribe(audio_path, language="zh")

text = ""
for segment in segments:
    text += segment.text + " "

print("="*50)
print(f"✅ 识别成功！\n\n📝 内容：{text.strip()}\n")

Technical Analysis

These scripts embed identifiers ...[truncated 1518 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all captured OpenClaw resource paths from the distributed package.
• Require an explicit audio path or resource object associated with the current request.
• Validate that the resource belongs to the current message, user, channel, and authorized session.
• Resolve and normalize the path, require it to remain inside an approved private resource directory, and verify ownership and file type.
• Reject stale resources and resources not created for the current processing request.
• Avoid printing complete transcripts to shared logs; return them only to the authorized consumer.
• Consolidate the duplicate scripts into one reviewed command-line utility with a required input argument.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts-/install.sh:105

Finding

Installer Unnecessarily Modifies Persistent Shell Startup Files

Content

View full analysis

Vulnerability Details

File Location: scripts-/install.sh:105-113
Vulnerability Type: Unsafe persistent configuration modification
Risk Level: Medium

Vulnerable Code

bash

# 配置环境变量提示
echo "🔑 配置环境变量（可选）"
echo ""
read -p "是否配置 OpenAI API Key? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.bashrc || true
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.zshrc || true
    echo "✓ OpenAI API Key 配置已添加到 shell rc 文件"
fi

Technical Analysis

When the user accepts the optional prompt, the installer appends a literal placeholder credential to both .bashrc and .zshrc. It does so without determining the active shell, checking for an existing variable, creating backups, or making the operation idempotent.

Local Faster-Whisper transcription does not require an OpenAI API key, so persistent modification of shell startup files exceeds the minimum configuration needed for the Skill's core function. The appended assignment can override a valid key when future shells start, while repeated installation creates duplicate configuration entries. The || true clauses also suppress write failures and can cause the installer to report success despite partial or failed changes.

Attack Path

1. A user runs install.sh and accepts the OpenAI API key configuration prompt.
2. The installer appends OPENAI_API_KEY="your_api_key" to both supported startup files.
3. A future Bash or Zsh session loads the modified configuration.
4. The placeholder assignment replaces or conflicts with a legitimate environment value.
5. Applications launched from that shell use the invalid value, causing authentication failures or unintended configuration behavior.
6. Repeated runs append additional entries, making it difficult to determine which value is effective.

Impact Assessment

This issue can persistently disrupt applicatio ...[truncated 312 chars]

Remediation

View remediation

Remediation Suggestions

• Do not modify shell startup files automatically; print scoped setup instructions instead.
• Do not write placeholder credentials into persistent configuration.
• Prefer a secrets manager, process-scoped environment variable, or permission-restricted application configuration file.
• If automated configuration is essential, request an actual value securely without echoing it, modify only the active shell's configuration, and obtain explicit confirmation.
• Detect and update existing entries idempotently rather than appending duplicates.
• Create a backup before modification and report failures instead of suppressing them with || true.
• Keep OpenAI configuration separate from the default local Faster-Whisper installation because it is not required for local transcription.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (27)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt-get update && sudo apt-get install -y ffmpeg

text

## 使用示例

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts-/install.sh (reported line 111)May include surrounding context.

sh

vices-speech
    echo "✓ Azure TTS SDK 已安装"
fi

read -p "是否安装 ElevenLabs CLI? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    pip install elevenlabs
    echo "✓ ElevenLabs SDK 已安装"
fi

echo ""

# 配置环境变量提示
echo "🔑 配置环境变量（可选）"
echo ""
read -p "是否配置 OpenAI API Key? [y/N] " -n 1 -r
echo
if [[ $REPLY =~ ^[Yy]$ ]]; then
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.bashrc || true
    echo "export OPENAI_API_KEY=\"your_api_key\"" >> ~/.zshrc || true
    echo "✓ OpenAI API Key 配置已添加到 shell rc 文件"
fi

echo ""

# 下载 Whisper 模型（首次运行自动下载）
echo "📥 Whisper 模型说明:"
echo ""
echo "首次运行时，Whisper 会自动下载模型文件到 ~/.cache/torch/hub/"
echo ""
echo "推荐模型大小:"
echo "  - base (142MB): 通用场景，CPU 友好"
echo "  - small (466MB): 生产环境，平衡性能"
echo "  - medium (769MB): 高精度需求，需要 GPU"
echo ""

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs downloading user audio and transcribing it, but does not warn about privacy, consent, retention, or handling of potentially sensitive voice data. Voice messages can contain biometric, personal, or confidential information, so omitting data-handling guidance increases the risk of unauthorized collection, over-retention, or improper disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt-get update && sudo apt-get install -y ffmpeg

text

## 使用示例

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script's comments, prompts, and status messages are entirely in Chinese, which imposes a specific language on users. Under the policy, this should be treated as a language/locale restriction unless the skill offers language choice or clearly documents that it is intended only for a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts-/install.sh (reported line 72)May include surrounding context.

sh

echo "✓ Whisper.cpp (Homebrew) 已安装"
    elif command -v apt-get &> /dev/null; then
        # Ubuntu/Debian
        sudo apt-get update
        sudo apt-get install -y whisper-cpp
        echo "✓ Whisper.cpp (apt) 已安装"
    else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts-/install.sh (reported line 73)May include surrounding context.

sh

echo "✓ Whisper.cpp (Homebrew) 已安装"
    elif command -v apt-get &> /dev/null; then
        # Ubuntu/Debian
        sudo apt-get update
        sudo apt-get install -y whisper-cpp
        echo "✓ Whisper.cpp (apt) 已安装"
    else

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script appends export lines to ~/.bashrc and ~/.zshrc, which persistently modifies the user's shell configuration. Even though it asks first, it does not clearly warn that it will write to startup files, can create duplicate entries, and stores placeholder secret configuration in files many users may not expect to be changed by an installer.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script states that model loading is 'only a check' and 'will not actually download', but constructing WhisperModel("base", device="cpu") can trigger network downloads and significant disk usage if the model is not cached. This is dangerous because an installer is making undeclared external network access and resource-consuming changes during a test step, which can surprise users and violate restricted or offline environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The transcription call hard-codes language="zh", which enforces a specific language/locale behavior. The file does not offer a user opt-in or parameter to choose another language, and there is no documented region-specific justification for restricting recognition to Chinese.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

A transcription script should not silently gain the ability to modify the host by installing packages during execution. This expands the script's privileges and attack surface beyond its stated purpose, making the skill more dangerous in agent or automation contexts where running the script may be assumed to be low risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The subprocess-based package installation occurs automatically after a missing import, with only a print message and no meaningful consent gate. In an automated skill context, that means executing external package-management actions on the host unexpectedly, which can violate least surprise and create supply-chain and environment-integrity risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script invokes pip as a subprocess at runtime when an import fails, which introduces package-management and code-execution behavior into a transcription utility. Installing and executing packages from the network without explicit user approval can change the runtime environment and exposes users to supply-chain risk if package resolution or indexes are compromised.

Content

Scanner excerpt · scripts-/transcribe.py (reported line 34)May include surrounding context.

python

except ImportError:
        print("❌ faster-whisper 未安装，正在尝试安装...")
        import subprocess
        subprocess.check_call([sys.executable, "-m", "pip", "install", "faster-whisper"])
        
        # 重试
        from faster_whisper import WhisperModel

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code hard-codes language="zh" for transcription, which imposes a specific language/locale behavior with no user opt-in or configurable alternative. This is a natural-language policy issue because the skill does not offer language selection and the file does not document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transcription call hard-codes language="zh", which imposes a specific language/locale behavior on all users. The file also uses Chinese-only user-facing text, but the clearest policy issue is the unconditional locale constraint in the transcription logic with no opt-in or explanation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The transcription call hard-codes language="zh", which enforces a specific language/locale behavior. This is a natural-language policy concern because the script does not offer user opt-in or any documented rationale for restricting recognition to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comments and transcribe call explicitly constrain recognition to Chinese via language="zh". For a code file, this is a natural-language locale policy issue because the script does not offer user opt-in or selection, and no region-specific justification is documented in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transcription call hard-codes language="zh", which imposes a specific language/locale behavior on all inputs. There is no user opt-in, alternate language selection, or justification that this tool is intentionally limited to Chinese-only use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script writes potentially sensitive transcription content to a fixed path in /tmp without user consent, access control handling, or cleanup. On multi-user systems or shared environments, temporary files can expose private audio-derived text, be read by other processes/users depending on permissions and umask, or be overwritten/scraped unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language comments and code hard-code Chinese as the transcription language via language="zh". This imposes a specific language/locale behavior without offering user opt-in or documenting that the skill is intentionally limited to a Chinese-only use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code comment and transcribe call explicitly constrain recognition to Chinese via language="zh". This is a natural-language locale policy issue because the script does not offer a user opt-in or configurable language selection, and no region-specific justification is documented in the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script automatically invokes pip at runtime to install a package from an external repository, which introduces supply-chain and network-execution risk. Even though the command is not shell-injected and uses a fixed package name, it still causes unreviewed code retrieval and installation during execution, which is dangerous in an agent skill context because it expands trust to PyPI and arbitrary transitive dependencies.

Content

Scanner excerpt · scripts-/transcribe_quick.py (reported line 14)May include surrounding context.

python

try:
    # 安装依赖（如果未安装）
    subprocess.run([sys.executable, "-m", "pip", "install", "faster-whisper", "--quiet"], check=True)
    
    from faster_whisper import WhisperModel

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transcription call hard-codes language="zh", which imposes a specific language/locale behavior on all users. This is a natural-language policy concern because the file provides no opt-in, fallback, or justification that the skill is intended only for Chinese-language audio.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill notes that WhisperModel initialization may automatically download a model, but it does not clearly warn that this triggers outbound network access to an external service. In restricted or sensitive environments, silent external downloads can violate policy, leak environment metadata, or introduce supply-chain and availability risks.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring says this is a 'skill registration script' that 'adds' the Whisper skill to the skill pool, and later output declares 'registration complete' and 'the skill has been registered'. In practice, the code only inspects local files/directories and enumerates skills; it does not add or modify any registry state.

Content

No source excerpt is available for this finding.