Feishu Edge Tts

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.0

Overview

This skill transparently turns provided text into audio and sends it to a configured Feishu chat, with expected credential and network use for that purpose.

Install only if you are comfortable sending the provided text to Edge TTS and uploading the resulting audio to Feishu. Use a least-privilege Feishu app, protect FEISHU_APP_SECRET, verify FEISHU_CHAT_ID before sending, and use --no-send when you only want local audio generation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description emphasizes free Edge TTS generation and '无需 API key', but the documented behavior also requires Feishu credentials, obtains access tokens, uploads audio, and sends messages to a chat. This mismatch can mislead users into underestimating the need for sensitive credentials and the fact that content will be transmitted to external services, increasing the chance of unintended data disclosure or misuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill does not warn that user-provided text is sent to external services for speech synthesis and then posted into a Feishu chat. If users supply sensitive or regulated content, they may unknowingly disclose it to third parties or broader chat audiences, making this a real privacy and data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.