Expression Coach 表达力训练教练

• Outcome: Review
• Latest audit: May 29, 2026 at 9:24 PM UTC
• Version:
  1.1.0

Overview

This speech-coaching skill is purpose-aligned, but it needs review because it can automatically save voice recordings, transcripts, scores, and speaking-analysis data to Feishu when tracking is enabled.

Install only if you are comfortable with voice practice data being analyzed and, when Bitable is enabled, stored in Feishu. Use a dedicated limited-access table and app, avoid raw-audio retention unless needed, and confirm how to pause logging, delete saved records, and disable the daily cron tips.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The trigger phrases shown in the README include very broad, everyday expressions such as “练一下” and “角色扮演,” which can cause accidental activation in unrelated conversations. In a voice-first skill, unintended activation can lead to unexpected collection of voice/text input, confusion, and accidental invocation of downstream features.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that user voice is transcribed with Whisper and that practice data may be logged to Feishu Bitable, but it does not clearly warn users about what data is processed, stored, retained, or shared with third parties. This creates a privacy and consent risk, especially because spoken responses may contain sensitive personal, workplace, or interpersonal information.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger list includes very broad everyday phrases such as “怎么说”, “话术”, and “我的数据”, which can cause the skill to activate in unintended contexts. This creates a real security and privacy risk because activation may lead to processing voice content, transcription, or data storage workflows without sufficiently explicit user intent.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The routing examples rely on ambiguous phrases like “练一下”, “模拟一下”, and “怎么说”, which overlap with ordinary conversation and may misclassify user intent. In this skill, misrouting is more dangerous because it can trigger collection of voice input, transcription, and optional persistence to Feishu Bitable.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup flow explains how to configure Feishu Bitable but does not clearly warn users that transcripts, analytics, improvement notes, and potentially raw voice files may be stored externally. This is a privacy vulnerability because users may consent to setup without understanding the sensitivity and persistence of the data being transmitted and retained.

VirusTotal

64/64 vendors flagged this skill as clean.