T08 · Insecure Dependencies
Warning
- Location
SKILL.md:11- Finding
Unpinned OpenAI Whisper Dependency Creates Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Expression Coach 表达力训练教练
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent voice-coaching tool, but its optional Feishu integration can automatically persist raw voice recordings, transcripts, scores, and analytics externally with limited consent and retention controls.
Install only if you are comfortable using a Chinese-first voice coach and, before enabling Feishu Bitable, confirm what will be saved, who can access the table, how recordings and transcripts can be deleted, and that the Feishu app uses least-privilege permissions. Prefer leaving Bitable and daily tips disabled unless you specifically want persistent cloud history.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:455- Finding
Feishu Application Secret and Access Token Are Passed Through Process Arguments
- Content
View full analysis
","app_secret":""}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])") ``` ```bash FILE_PATH="/path/to/voice.ogg" FILE_SIZE=$(stat -f%z "$FILE_PATH" 2>/dev/null || stat -c%s "$FILE_PATH") UPLOAD_RESULT=$(curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/medias/upload_all' \ -H "Authorization: Bearer $TOKEN" \ -F "file_name=voice_practice.ogg" \ -F "parent_type=bitable_file" \ -F "parent_node=" \ -F "size=$FILE_SIZE" \ -F "file=@$FILE_PATH") FILE_TOKEN=$(echo "$UPLOAD_RESULT" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['file_token'])") ``` ### Technical Analysis The instructions require reading the Feishu application ID and application secret from the global `openclaw.json` configuration. The values are then interpolated into curl’s `-d` argument. The resulting tenant access token is likewise interpolated into the `Authorization` command-line argument. On systems where process arguments are visible to other local users, process monitors, tracing systems, terminal recorders, or diagnostic tooling, these values may be exposed while curl is running. Shell debugging such as `set -x` could also record the fully expanded commands. Error-reporting or agent execution logs may retain command arguments beyond the lifetime of the process. Access to application credentials is relevant to the optional Feishu upload feature, but directly reading a broader OpenClaw configuration file and manually handling the secret creates greater exposure than using an authenticated Feishu integration ...[truncated 1557 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Step 1: 获取 tenant_access_token
从 OpenClaw 的
openclaw.json配置中读取飞书 appId 和 appSecret：bash TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id":"<FROM_CONFIG>","app_secret":"<FROM_CONFIG>"}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash FILE_PATH="/path/to/voice.ogg" FILE_SIZE=$(stat -f%z "$FILE_PATH" 2>/dev/null || stat -c%s "$FILE_PATH") UPLOAD_RESULT=$(curl -s -X POST 'https://open.feishu.cn/open-apis/drive/v1/medias/upload_all' \ -H "Authorization: Bearer $TOKEN" \ -F "file_name=voice_practice.ogg" \ -F "parent_type=bitable_file" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README states that the AI will '自动配置表结构并创建 config.json' after the user sends a Bitable link, but it does not clearly warn that this modifies the local environment by creating a configuration file. In an agent setting, undisclosed file creation is risky because users may not realize the skill can persist configuration or alter local state based on conversational input.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented trigger phrases are broad, natural-language expressions such as '练一下', '角色扮演', and '查看进步' that can plausibly appear in ordinary conversation. In an agent environment, this can cause accidental invocation or unintended context switching, leading the skill to activate when the user did not explicitly intend to use it and potentially process voice content or perform follow-on actions unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list includes broad phrases such as “怎么说”, “话术”, and “我的数据”, which are common in ordinary conversation and can cause the skill to activate when the user did not intend to invoke it. Because this skill can process voice, analyze transcripts, and optionally persist data to Feishu Bitable, accidental activation increases the chance of unnecessary collection or disclosure of sensitive user content.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The reporting feature aggregates all historical practice inputs into trend summaries, weakest-dimension analysis, and habit reports, which broadens the exposure of prior user content beyond the original one-off coaching interaction. Even if intended for coaching, this increases the sensitivity of the dataset by creating behavioral profiles and consolidated summaries that may reveal personal habits, work topics, or communication weaknesses.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill specifies automatic recording of audio attachments, transcripts, scoring, and analysis into Bitable, but does not require a clear privacy notice or explicit informed consent at the time data is stored. This is risky because voice content and derived speaking analysis can contain personal, behavioral, or workplace-sensitive information, and users may not realize that raw files and detailed assessments are being retained externally.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Once Bitable is configured, the skill directs persistent storage of raw voice files, full transcripts, detailed scoring, filler-word statistics, and improvement notes for every practice session. This is excessive data retention by default for a coaching skill and creates avoidable privacy and security exposure if the external workspace is misconfigured, shared broadly, or later accessed by unauthorized parties.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to send app credentials to Feishu to obtain a tenant access token, which is an external transmission of secrets and enables subsequent upload/write operations to a third-party service. While this may be functionally necessary for Feishu integration, it is still security-relevant because compromise, logging leakage, or misuse of the token can expose stored user practice data and associated workspace contents.
- Content
Step 1: 获取 tenant_access_token
从 OpenClaw 的
openclaw.json配置中读取飞书 appId 和 appSecret：bash TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d '{"app_id":"<FROM_CONFIG>","app_secret":"<FROM_CONFIG>"}' \ | python3 -c "import json,sys; print(json.load(sys.stdin)['tenant_access_token'])")
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file presents all scenario instructions and role descriptions exclusively in Chinese, which can impose a language/locale constraint on users without stating that the skill is Chinese-only or offering an alternative. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file contains end-user instructional content only in Chinese, and nowhere indicates that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without user choice is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file presents all guidance in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a locale-policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file presents all prompts and labels exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the policy rule for language/locale constraints, forcing a specific language without opt-in is a reportable issue.
- Content