Security audit

语音交互技能-feishu&qq-byLi

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main Feishu voice features are coherent, but it includes unsafe install/runtime code and a manual repair script that can modify another OpenClaw extension.

Review before installing. Do not run fix-debug-leak.sh unless you intentionally want this package to alter a QQBot extension and have a tested backup. Prefer official dependency/model sources, avoid running installers as root, restrict .env permissions to 600, use least-privilege Feishu credentials, and treat TTS text/audio paths as unsafe until the Python heredoc interpolation bugs are fixed.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:127
Finding: Unverified Remote Shell Installer Download and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/tts-voice.sh:42
Finding: Python Code Injection Through TTS Text and Output Path Interpolation
Content: View full analysis
/tmp/tts-injection"); # ``` The output path is also inserted into a double-quoted Python string and can be abused if a caller controls it. ### Attack Path 1. An attacker supplies or influences text that will be passed to `tts-voice.sh`. 2. The text contains a triple-quote terminator followed by Python statements. 3. Bash expands `$TEXT` into the heredoc. 4. Python parses the expanded heredoc as source code rather than data. 5. The injected statement executes before or during TTS synthesis. 6. The attacker obtains command execution with the privileges of the OpenClaw or Skill process. ### Impact Assessment Exploitation can read Feishu credentials from the environment or `.env` file, access OpenClaw configuration, modify files writable by the Agent, execute network requests, and run arbitrary operati ...[truncated 134 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fast-whisper-fast.sh:65
Finding: Python Code Injection Through Audio and Model Configuration Values
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/install.sh:190
Finding: Unpinned Python Packages and Unverified Model Mirrors
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/fix-debug-leak.sh:43
Finding: Cross-Extension Source Modification Outside the Skill Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.sh:273
Finding: Credential Configuration File Created Without Enforced Restrictive Permissions
Content: View full analysis
> "${SCRIPT_DIR}/.env" ``` ### Technical Analysis The installer creates `.env` using ordinary `cp` and does not enforce mode `0600` or set a restrictive umask. The user is then instructed to place `FEISHU_APP_ID` and `FEISHU_APP_SECRET` in this file. Depending on the source file mode, current umask, parent-directory permissions, and deployment environment, the resulting credential file may be readable by other local users or processes. Documentation elsewhere recommends `chmod 600`, but the executable installation workflow does not apply that protection. Runtime scripts also source this file as shell code. Consequently, write access to `.env` is equivalent to code-execution access whenever those scripts run. ### Attack Path 1. The installer creates `scripts/.env` with permissions derived from the example file and current umask. 2. The operator adds real Feishu credentials. 3. Another local account or compromised process reads the file if permissions permit. 4. The attacker uses the App ID and secret to request Feishu access tokens within the application's granted permissions. 5. If an attacker can modify the file, they can insert shell commands that execute when runtime or health-check scripts source `.env`. ### Impact Assessment Confidentiality impact includes disclosure of the Feishu ap ...[truncated 274 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (150)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · FIX_DEBUG_INFO_LEAK.md (reported line 79)May include surrounding context.
备份并清理引用索引缓存

mv ~/.openclaw/qqbot/data/ref-index.jsonl ~/.openclaw/qqbot/data/ref-index.jsonl.bak

或

rm ~/.openclaw/qqbot/data/ref-index.jsonl

text
### 2. 重启 QQBot 扩展

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/USAGE.md (reported line 175)May include surrounding context.
备份并清理引用索引缓存

mv ~/.openclaw/qqbot/data/ref-index.jsonl ~/.openclaw/qqbot/data/ref-index.jsonl.bak

或

rm ~/.openclaw/qqbot/data/ref-index.jsonl

text
### 2. 重启 QQBot 扩展

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly documents a fix-debug-leak.sh script that modifies other OpenClaw extensions under paths like /root/.openclaw/extensions/qqbot/, which is outside the declared scope of a Feishu audio skill. Cross-extension source modification creates a supply-chain and integrity risk because installing or using this skill may alter unrelated components, potentially introducing persistence, breaking trust boundaries, or tampering with other agents' behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A Feishu audio processing skill has no legitimate need to alter other installed extensions, so the documented capability is unjustified and dangerous in context. Even if framed as a debugging fix, giving the skill authority to rewrite unrelated extensions increases the blast radius from a narrow media-processing tool to a platform-wide tampering mechanism.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 63% confidence
Finding: Instructing users to 'source .env' can expose secrets to the current interactive shell session and any child processes, increasing the chance of accidental leakage through shell history, debugging output, process environments, or unrelated tools launched from that shell. In a skill that also downloads models and invokes multiple scripts and services, broad environment propagation makes credential handling more fragile.
Content: Scanner excerpt · README_EN.md (reported line 76)May include surrounding context.
export FEISHU_APP_SECRET="xxx"

4. Load environment variables

source .env

text
### Run Installation

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Advising users to 'source .env' can expose secrets to the current shell session and any child processes, increasing the chance of accidental disclosure through process inspection, debug output, shell history/workflow mistakes, or inherited environments. In multi-user or poorly isolated environments, this broadens credential exposure beyond the minimum needed.
Content: Scanner excerpt · SECURITY.md (reported line 40)May include surrounding context.
vi .env

加载环境变量

source .env

text
**安全提示**：

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document makes a materially misleading security/privacy claim by stating the skill does not collect voice content or chat records, while elsewhere it acknowledges transmitting text to Edge TTS, sending voice messages via Feishu, and storing temporary audio files locally. This can cause operators to deploy the skill under false assumptions about data handling, leading to privacy, compliance, and consent failures.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PRIVACY_CHECK.md (reported line 111)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 76)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README_EN.md (reported line 69)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 37)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY_CONFIG.md (reported line 18)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY_CONFIG.md (reported line 21)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY_CONFIG.md (reported line 23)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY_CONFIG.md (reported line 24)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY_WARNING.md (reported line 28)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/MODEL_CHOICE.md (reported line 30)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/MODEL_CHOICE.md (reported line 91)May include surrounding context.

不会意外提交到版本控制

每个用户独立配置

备选：使用 .env 文件

bash
# 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/common.sh (reported line 165)May include surrounding context.
sh
- 不会意外提交到版本控制 - 每个用户独立配置 ### 备选：使用 .env 文件 ```bash # 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-with-model-choice.sh (reported line 292)May include surrounding context.
sh
- 不会意外提交到版本控制 - 每个用户独立配置 ### 备选：使用 .env 文件 ```bash # 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-with-model-choice.sh (reported line 310)May include surrounding context.
sh
- 不会意外提交到版本控制 - 每个用户独立配置 ### 备选：使用 .env 文件 ```bash # 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-with-model-choice.sh (reported line 312)May include surrounding context.
sh
- 不会意外提交到版本控制 - 每个用户独立配置 ### 备选：使用 .env 文件 ```bash # 创建 .env 文件

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/install-with-model-choice.sh (reported line 313)May include surrounding context.
sh
- 不会意外提交到版本控制 - 每个用户独立配置 ### 备选：使用 .env 文件 ```bash # 创建 .env 文件

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Tool Parameter Abuse

备份并清理引用索引缓存

或

Tool Parameter Abuse

备份并清理引用索引缓存

或

Description-Behavior Mismatch

Context-Inappropriate Capability

Credential Access

4. Load environment variables

Credential Access

加载环境变量

Intent-Code Divergence

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

备选：使用 .env 文件

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access