Expression Coach 表达力训练教练

Security checks across malware telemetry and agentic risk

Overview

This speech-coaching skill is purpose-aligned, but it needs review because it can automatically save voice recordings, transcripts, scores, and speaking-analysis data to Feishu when tracking is enabled.

Install only if you are comfortable with voice practice data being analyzed and, when Bitable is enabled, stored in Feishu. Use a dedicated limited-access table and app, avoid raw-audio retention unless needed, and confirm how to pause logging, delete saved records, and disable the daily cron tips.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger phrases shown in the README include very broad, everyday expressions such as “练一下” and “角色扮演,” which can cause accidental activation in unrelated conversations. In a voice-first skill, unintended activation can lead to unexpected collection of voice/text input, confusion, and accidental invocation of downstream features.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README states that user voice is transcribed with Whisper and that practice data may be logged to Feishu Bitable, but it does not clearly warn users about what data is processed, stored, retained, or shared with third parties. This creates a privacy and consent risk, especially because spoken responses may contain sensitive personal, workplace, or interpersonal information.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes very broad everyday phrases such as “怎么说”, “话术”, and “我的数据”, which can cause the skill to activate in unintended contexts. This creates a real security and privacy risk because activation may lead to processing voice content, transcription, or data storage workflows without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The routing examples rely on ambiguous phrases like “练一下”, “模拟一下”, and “怎么说”, which overlap with ordinary conversation and may misclassify user intent. In this skill, misrouting is more dangerous because it can trigger collection of voice input, transcription, and optional persistence to Feishu Bitable.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The setup flow explains how to configure Feishu Bitable but does not clearly warn users that transcripts, analytics, improvement notes, and potentially raw voice files may be stored externally. This is a privacy vulnerability because users may consent to setup without understanding the sensitivity and persistence of the data being transmitted and retained.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal