Li Feishu Audio

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:48 AM UTC
• Version: 0.1.3

Overview

The skill has a legitimate Feishu voice assistant purpose, but its scripts contain unsafe code-execution, credential-output, dependency, and cleanup-path risks that need review before installation.

Install only after reviewing or fixing the scripts. At minimum, avoid running it with privileged accounts, keep Feishu credentials tightly scoped and rotated, do not paste untrusted content into the shell scripts, prefer a private TEMP_DIR, redact appSecret output, pin dependencies and model revisions, and replace the heredoc-generated Python with fixed Python modules that receive text and paths as data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:35

Finding

Unsafe Remote Installer Execution Recommendation

Content

View full analysis

/dev/null; then echo "❌ 错误：需要 uv 包管理器" echo " 安装：curl -LsSf https://astral.sh/uv/install.sh | sh" exit 1 fi ``` ### Technical Analysis The installer does not execute this command automatically, but it instructs users to download mutable content from an external URL and pipe it directly into `sh`. The downloaded script is not pinned to a version, inspected, signature-verified, or checked against a cryptographic digest. Although `astral.sh` is related to the legitimate `uv` project, direct remote-to-shell execution means the effective code can change after this Skill has been audited. Compromise of the remote host, its deployment pipeline, DNS resolution, or the network trust chain could result in arbitrary replacement code being executed. ### Attack Path 1. A user runs `scripts/install.sh` without `uv` installed. 2. The installer prints the `curl ... | sh` command as the prescribed installation method. 3. The user copies and executes the command. 4. `curl` retrieves the current, unaudited response from the external host. 5. The response is immediately interpreted by the local shell. 6. A compromised or replaced response executes arbitrary commands with the user's privileges. ### Impact Assessment Successful exploitation provides arbitrary command execution as the account running the installation command. The payload could access that user's files, OpenClaw configuration, Feishu credentials, environment variables, and any other resources available to the account. It does not inherently grant root privileges unless the user executes it as root or the payload chains another privilege-escalation flaw. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tts-voice.sh:27

Finding

Arbitrary Python Code Execution Through TTS Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/fast-whisper-fast.sh:27

Finding

Arbitrary Python Code Execution Through Audio and Model Paths

Content

View full analysis

" exit 1 fi AUDIO_FILE="$1" if [ ! -f "$AUDIO_FILE" ]; then echo "错误：文件不存在 - $AUDIO_FILE" exit 1 fi "$VENV_PYTHON" << EOF from faster_whisper import WhisperModel model = WhisperModel("tiny", device="cpu", compute_type="int8", download_root="$MODEL_DIR") segments, info = model.transcribe("$AUDIO_FILE", language="zh") for segment in segments: print("[%.2fs -> %.2fs] %s" % (segment.start, segment.end, segment.text)) EOF ``` ### Technical Analysis `MODEL_DIR` and `AUDIO_FILE` are inserted directly into executable Python source. The file-existence check confirms only that the supplied path exists; it does not make the path safe for inclusion in a Python string literal. A filename or model directory containing quotes, newlines, or Python syntax can terminate the intended string and inject statements. The generated program is then executed by `VENV_PYTHON`. ### Attack Path 1. An attacker creates or causes an attachment to be stored using a crafted filename, or influences `FAST_WHISPER_MODEL_DIR`. 2. The path refers to an existing file or directory, allowing validation to pass. 3. The path is embedded into the heredoc as Python source without escaping. 4. The crafted path terminates the intended string literal and introduces Python statements. 5. Python executes the injected code with the Skill's privileges. ### Impact Assessment Successful exploitation enables arbitrary code execution as the user running the Skill. Accessible scope includes user files, OpenClaw configuration, Feishu credentials, local media, installed Skill files, and outbound network access available to the pro ...[truncated 69 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:129

Finding

Feishu Application Secret Exposed in Installer Output

Content

View full analysis

/dev/null) if [ "$FEISHU_CONFIG" != "null" ] && [ "$FEISHU_CONFIG" != "" ]; then echo "✅ OpenClaw 飞书配置已存在" echo "$FEISHU_CONFIG" | jq . ``` ### Technical Analysis The installer reads the entire `.channels.feishu` object and prints it to standard output. According to the documented configuration format, this object can contain both `appId` and `appSecret`. Installation output may be retained in terminal scrollback, CI logs, package-manager logs, support transcripts, or centralized observability systems. Users with access to those logs may not otherwise have permission to read `openclaw.json`. ### Attack Path 1. A valid Feishu configuration containing `appSecret` exists in `openclaw.json`. 2. An administrator or automated system runs `scripts/install.sh`. 3. The installer reads and prints the complete Feishu configuration object. 4. Output is captured in a terminal history, build log, or centralized logging system. 5. Another user or service with log access extracts the exposed secret. 6. The attacker uses the credentials against Feishu APIs within the application's granted permissions. ### Impact Assessment Exposure of the application secret may allow unauthorized token acquisition and Feishu API operations permitted to the configured application. The exact scope depends on the application's Feishu permissions. Potential effects include unauthorized message operations and access to application-authorized tenant resources. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:77

Finding

Unpinned Python Dependencies and Unverified Model Download

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/handlers/voice.py:55

Finding

Race-Prone and Predictable Temporary Audio Files

Content

View full analysis

tuple[bool, int]: """发送语音回复到飞书，返回 (是否成功, 时长毫秒)""" output_opus = "/tmp/reply.opus" ``` ```bash TEMP_DIR="${TEMP_DIR:-/tmp}" OPUS_FILE="${TEMP_DIR}/feishu-audio-$(date +%s).opus" ffmpeg -y -i "$AUDIO_FILE" -acodec libopus -ar 48000 -ac 1 "$OPUS_FILE" 2>/dev/null ``` ```python temp_mp3 = tempfile.mktemp(suffix=".mp3") ``` ### Technical Analysis `tempfile.mktemp()` returns a filename without atomically creating it, leaving a time-of-check/time-of-use window in which another local process can create the path first. `/tmp/reply.opus` is a fixed, globally predictable path shared by every request. The Feishu sender uses second-resolution timestamps, so concurrent operations in the same second can select the same filename. FFmpeg is invoked with `-y`, allowing existing destinations to be overwritten. On systems where multiple users or processes share the temporary directory, an attacker can pre-create a file or symbolic link at a predicted path. Concurrent legitimate requests can also overwrite or read each other's audio without an attacker. ### Attack Path 1. A local attacker predicts or observes the temporary destination. 2. The attacker pre-creates that path, potentially as a symbolic link to another user-writable target. 3. The Skill invokes Edge TTS or FFmpeg using the predictable destination. 4. The output operation follows or overwrites the pre-created target, depending on platform and tool behavior. 5. Alternatively, concurrent Skill requests use the same fixed output path and replace each other's replies. 6. Th ...[truncated 362 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (84)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

The instruction to source .env can be dangerous because shell sourcing executes the file as code, not merely as data. If the .env file is tampered with or copied from an untrusted source, this can lead to arbitrary command execution in the operator's shell; this risk is heightened in setup docs because users often run commands verbatim.

Content

Scanner excerpt · README.md (reported line 76)May include surrounding context.

export FEISHU_APP_SECRET="xxx"

4. 加载环境变量

source .env

text

### 运行安装

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

bash

# 复制模板
cd skills/li-feishu-audio/scripts
cp .env.example .env

# 编辑填入实际值
vi .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_EN.md (reported line 66)May include surrounding context.

bash

# 复制模板
cd skills/li-feishu-audio/scripts
cp .env.example .env

# 编辑填入实际值
vi .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 34)May include surrounding context.

bash

# 复制模板
cd skills/li-feishu-audio/scripts
cp .env.example .env

# 编辑填入实际值
vi .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

md

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_EN.md (reported line 69)May include surrounding context.

md

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README_EN.md (reported line 76)May include surrounding context.

md

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.

md

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 40)May include surrounding context.

md

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 111)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 114)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 116)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 119)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 178)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 180)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 205)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 206)May include surrounding context.

sh

cp .env.example .env

# 编辑填入实际值
vi .env

# 加载环境变量
source .env

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documentation describes a voice-processing skill, but it also includes cleanup and retention-based deletion behavior that is not reflected in the top-level declared purpose. Hidden or under-declared file deletion logic is dangerous because users may enable the skill expecting media handling only, while it can also remove directories/files and apply disk-management policies.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documentation describes a voice-processing skill, but it also includes cleanup and retention-based deletion behavior that is not reflected in the top-level declared purpose. Hidden or under-declared file deletion logic is dangerous because users may enable the skill expecting media handling only, while it can also remove directories/files and apply disk-management policies.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documentation describes a voice-processing skill, but it also includes cleanup and retention-based deletion behavior that is not reflected in the top-level declared purpose. Hidden or under-declared file deletion logic is dangerous because users may enable the skill expecting media handling only, while it can also remove directories/files and apply disk-management policies.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documentation describes a voice-processing skill, but it also includes cleanup and retention-based deletion behavior that is not reflected in the top-level declared purpose. Hidden or under-declared file deletion logic is dangerous because users may enable the skill expecting media handling only, while it can also remove directories/files and apply disk-management policies.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script sources a local .env file as shell code, not as inert key/value data. If an attacker can modify scripts/.env, they can execute arbitrary commands with the privileges of whoever runs the cleanup script, and they can also influence variables like TEMP_DIR used in destructive file operations.

Content

Scanner excerpt · scripts/cleanup-tts.sh (reported line 8)May include surrounding context.

sh

# 加载用户配置的环境变量
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
if [ -f "${SCRIPT_DIR}/.env" ]; then
    source "${SCRIPT_DIR}/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Although this line is part of the same block, it contributes to the unsafe pattern where .env contents are executed in the current shell context before destructive operations occur. In this skill, that is more dangerous because the loaded values directly affect paths later passed to rm and glob expansion.

Content

Scanner excerpt · scripts/cleanup-tts.sh (reported line 9)May include surrounding context.

sh

# 加载用户配置的环境变量
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
if [ -f "${SCRIPT_DIR}/.env" ]; then
    source "${SCRIPT_DIR}/.env"
fi

KEEP_COUNT=${1:-10}

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This deletion uses an environment-controlled path without quoting or path validation. If TEMP_DIR is empty, malformed, or set to an unsafe location via the sourced .env, the command may delete unintended files matching those names elsewhere on the filesystem; word splitting and globbing further increase risk.

Content

Scanner excerpt · scripts/cleanup-tts.sh (reported line 67)May include surrounding context.

sh

# 4. 清理脚本临时文件
echo ""
echo "清理脚本临时文件..."
rm -f ${TEMP_DIR}/feishu-test.mp3 ${TEMP_DIR}/test-voice.mp3 ${TEMP_DIR}/tts-test.mp3 2>/dev/null
rm -f ${TEMP_DIR}/feishu-audio-*.opus 2>/dev/null

echo ""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This command performs wildcard deletion in an environment-controlled directory without quoting or validating the base path. In combination with sourcing .env, an attacker can redirect the cleanup target to an arbitrary location and cause broad file deletion of '*.opus' files, making this a real destructive-path vulnerability.

Content

Scanner excerpt · scripts/cleanup-tts.sh (reported line 68)May include surrounding context.

sh

echo ""
echo "清理脚本临时文件..."
rm -f ${TEMP_DIR}/feishu-test.mp3 ${TEMP_DIR}/test-voice.mp3 ${TEMP_DIR}/tts-test.mp3 2>/dev/null
rm -f ${TEMP_DIR}/feishu-audio-*.opus 2>/dev/null

echo ""
echo "=== 清理完成 ==="