Expression Coach 表达力训练教练

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:52 AM UTC
• Version: 1.1.0

Overview

The skill is a coherent voice-coaching tool, but its optional Feishu integration can automatically persist raw voice recordings, transcripts, scores, and analytics externally with limited consent and retention controls.

Install only if you are comfortable using a Chinese-first voice coach and, before enabling Feishu Bitable, confirm what will be saved, who can access the table, how recordings and transcripts can be deleted, and that the Feishu app uses least-privilege permissions. Prefer leaving Bitable and daily tips disabled unless you specifically want persistent cloud history.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11
• Finding: Unpinned OpenAI Whisper Dependency Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:11-16`; also documented in `README.md:49-57` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code From `SKILL.md:11-16`: ```yaml requires: bins: [whisper] install: - id: whisper kind: pip package: openai-whisper bins: [whisper] label: Install OpenAI Whisper (pip) ``` The equivalent manual installation instruction in `README.md:49-57` is: ```bash clawhub install expression-coach ``` ```bash pip install openai-whisper ``` ### Technical Analysis The Skill installs `openai-whisper` without a fixed version, package hash, or reviewed dependency lock file. Consequently, the code installed for the same Skill version can change over time. Python package installation can execute package build logic and installs transitive dependencies. A compromised future release, compromised transitive dependency, or unsafe package-index configuration could therefore introduce arbitrary code during installation or subsequent Whisper execution. The package name appears to refer to the legitimate OpenAI Whisper distribution, and the audit found no evidence of intentional dependency confusion or typosquatting. The issue is the absence of reproducible dependency controls rather than evidence that the current package is malicious. ### Attack Path 1. An attacker compromises the package, one of its transitive dependencies, or the package-index resolution path. 2. A user installs the Skill or follows the documented `pip install openai-whisper` command. 3. Pip resolves the mutable latest release instead of a previously reviewed version. 4. Malicious build or runtime code executes under the account performing the installation. 5. The malicious dependency gains access to data and resources available to that account. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the account running pip o ...[truncated 429 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `openai-whisper` to a reviewed exact version rather than resolving the latest release. 2. Pin all transitive dependencies through a lock file or constraints file. 3. Require package hashes, such as through `pip install --require-hashes`, where supported by the Skill installation mechanism. 4. Document the approved package index and prevent fallback to untrusted indexes. 5. Install the dependency in an isolated virtual environment or container using an unprivileged account. 6. Add a dependency-update process that reviews release changes and regenerates verified hashes before changing versions. 7. Keep the Skill metadata and README installation instructions consistent with the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:455
• Finding: Feishu Application Secret and Access Token Are Passed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:455-475` **Vulnerability Type**: Sensitive credentials exposed through shell command arguments **Risk Level**: Medium ### Vulnerable Code ```bash TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id":"<FROM_CONFIG>","app_secret":"<FROM_CONFIG>"}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") ``` ```bash FILE_PATH="/path/to/voice.ogg" FILE_SIZE=$(stat -f%z "$FILE_PATH" 2>/dev/null || stat -c%s "$FILE_PATH") UPLOAD_RESULT=$(curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/medias/upload_all' \ -H "Authorization: Bearer $TOKEN" \ -F "file_name=voice_practice.ogg" \ -F "parent_type=bitable_file" \ -F "parent_node=<APP_TOKEN_FROM_CONFIG>" \ -F "size=$FILE_SIZE" \ -F "file=@$FILE_PATH") FILE_TOKEN=$(echo "$UPLOAD_RESULT" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['file_token'])") ``` ### Technical Analysis The instructions require reading the Feishu application ID and application secret from the global `openclaw.json` configuration. The values are then interpolated into curl’s `-d` argument. The resulting tenant access token is likewise interpolated into the `Authorization` command-line argument. On systems where process arguments are visible to other local users, process monitors, tracing systems, terminal recorders, or diagnostic tooling, these values may be exposed while curl is running. Shell debugging such as `set -x` could also record the fully expanded commands. Error-reporting or agent execution logs may retain command arguments beyond the lifetime of the process. Access to application credentials is relevant to the optional Feishu upload feature, but directly reading a broader OpenClaw configuration file and manually handling the secret creates greater exposure than using an authenticated Feishu integration ...[truncated 1557 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an existing authenticated Feishu tool or SDK that obtains and refreshes tokens internally without exposing application secrets to generated shell commands. 2. Avoid placing secrets or bearer tokens in process arguments. Supply sensitive request data through protected standard input or another mechanism that does not expose values in the command line. 3. Disable shell tracing before handling credentials and ensure command-execution logs redact request bodies and authorization headers. 4. Read only the specific credential fields required for Feishu access rather than exposing the complete global OpenClaw configuration to the Skill. 5. Apply least-privilege Feishu permissions so the application can access only the intended Bitable and media-upload operations. 6. Store configuration with restrictive filesystem permissions and never write the application secret or access token into `config.json`. 7. Validate `FILE_PATH` against the expected voice-message attachment before upload to prevent unintended local-file disclosure. 8. Add explicit user consent before uploading recordings, along with retention, deletion, and access-control guidance. 9. Rotate the Feishu application secret and revoke active tokens if command arguments or execution logs may already have captured them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

External Script Fetching

High

• Category: Supply Chain

Content

#### Step 1: 获取 tenant_access_token
从 OpenClaw 的 `openclaw.json` 配置中读取飞书 appId 和 appSecret：
```bash
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id":"<FROM_CONFIG>","app_secret":"<FROM_CONFIG>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
FILE_PATH="/path/to/voice.ogg"
FILE_SIZE=$(stat -f%z "$FILE_PATH" 2>/dev/null || stat -c%s "$FILE_PATH")
UPLOAD_RESULT=$(curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/medias/upload_all' \
  -H "Authorization: Bearer $TOKEN" \
  -F "file_name=voice_practice.ogg" \
  -F "parent_type=bitable_file" \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that the AI will '自动配置表结构并创建 config.json' after the user sends a Bitable link, but it does not clearly warn that this modifies the local environment by creating a configuration file. In an agent setting, undisclosed file creation is risky because users may not realize the skill can persist configuration or alter local state based on conversational input.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The documented trigger phrases are broad, natural-language expressions such as '练一下', '角色扮演', and '查看进步' that can plausibly appear in ordinary conversation. In an agent environment, this can cause accidental invocation or unintended context switching, leading the skill to activate when the user did not explicitly intend to use it and potentially process voice content or perform follow-on actions unexpectedly.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad phrases such as “怎么说”, “话术”, and “我的数据”, which are common in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill can process voice, analyze transcripts, and optionally persist data to Feishu Bitable, accidental activation increases the chance of unnecessary collection or disclosure of sensitive user content.

Ssd 3

Medium

• Confidence: 88% confidence
• Finding: The reporting feature aggregates all historical practice inputs into trend summaries, weakest-dimension analysis, and habit reports, which broadens the exposure of prior user content beyond the original one-off coaching interaction. Even if intended for coaching, this increases the sensitivity of the dataset by creating behavioral profiles and consolidated summaries that may reveal personal habits, work topics, or communication weaknesses.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill specifies automatic recording of audio attachments, transcripts, scoring, and analysis into Bitable, but does not require a clear privacy notice or explicit informed consent at the time data is stored. This is risky because voice content and derived speaking analysis can contain personal, behavioral, or workplace-sensitive information, and users may not realize that raw files and detailed assessments are being retained externally.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: Once Bitable is configured, the skill directs persistent storage of raw voice files, full transcripts, detailed scoring, filler-word statistics, and improvement notes for every practice session. This is excessive data retention by default for a coaching skill and creates avoidable privacy and security exposure if the external workspace is misconfigured, shared broadly, or later accessed by unauthorized parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

#### Step 1: 获取 tenant_access_token
从 OpenClaw 的 `openclaw.json` 配置中读取飞书 appId 和 appSecret：
```bash
TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d '{"app_id":"<FROM_CONFIG>","app_secret":"<FROM_CONFIG>"}' \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")

• Confidence: 91% confidence
• Finding: The skill instructs the agent to send app credentials to Feishu to obtain a tenant access token, which is an external transmission of secrets and enables subsequent upload/write operations to a third-party service. While this may be functionally necessary for Feishu integration, it is still security-relevant because compromise, logging leakage, or misuse of the token can expose stored user practice data and associated workspace contents.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all scenario instructions and role descriptions exclusively in Chinese, which can impose a language/locale constraint on users without stating that the skill is Chinese-only or offering an alternative. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file contains end-user instructional content only in Chinese, and nowhere indicates that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without user choice is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file presents all guidance in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a locale-policy concern.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file presents all prompts and labels exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a reportable issue.

Static analysis

No suspicious patterns detected.