Security audit

Feishu Edge Tts

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: generates speech with Edge TTS and sends it to a configured Feishu chat, with some setup and privacy cautions users should understand.

Install this only if you are comfortable using Feishu app credentials and sending the provided text/audio through Edge TTS and Feishu. Use a low-privilege Feishu app, avoid putting secrets in shared shell history or committed files, and prefer a virtual environment or pinned dependency install for edge-tts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:16
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description says the skill is 'free' and '无需 API key', but actual use requires Feishu credentials and external API interaction to authenticate, upload media, and send messages. This mismatch is security-relevant because it can mislead users about required secrets, network behavior, and trust assumptions, causing them to provide credentials or transmit content without informed consent.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 214)May include surrounding context.
sh
echo -e "${BLUE}📤 上传到飞书...${NC}" # 获取 Token TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 226)May include surrounding context.
sh
fi # 上传文件 UPLOAD_RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $TOKEN" \ -F "type=audio" \ -F "file=@$TEMP_OPUS" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 250)May include surrounding context.
sh
echo -e "${BLUE}📤 发送语音消息...${NC}" # 发送消息 RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell-based behavior and operational steps but declares no tool scope or permission boundaries. This is dangerous because users and hosting platforms are not clearly informed that the skill needs shell execution and likely outbound network access, which weakens least-privilege controls and increases the chance of unintended command execution or data egress.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill does not warn that provided text may be sent to external services for speech synthesis and then delivered into a Feishu chat. This creates a privacy and data-handling risk because users may input sensitive content under the assumption that processing is local or not redistributed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The setup instructions require Feishu application credentials via environment variables but provide no guidance on secure secret handling. This is risky because users may store secrets insecurely in shell history, shared profiles, screenshots, or logs, increasing the chance of credential leakage and subsequent unauthorized messaging or API use.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The configuration hard-codes a Chinese locale voice (zh-CN-XiaoxiaoNeural) as the default. This creates a language/locale policy concern because the skill appears to impose a specific locale choice without indicating user selection or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script's user-facing help and descriptions are entirely in Chinese, including usage, options, and status messages, with no indication that other languages are supported or that the locale restriction is intentional. This can violate language or locale policy when users are not given a choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends user-supplied text to the external Edge TTS service to synthesize speech, but it does not clearly warn the user that the text content leaves the local environment. If users pass sensitive text, secrets, or private data, this creates an unannounced confidentiality risk through third-party transmission.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 214)May include surrounding context.
sh
echo -e "${BLUE}📤 上传到飞书...${NC}" # 获取 Token TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 250)May include surrounding context.
sh
echo -e "${BLUE}📤 发送语音消息...${NC}" # 发送消息 RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language instructions and headings are presented entirely in Chinese, while the policy requires avoiding forced language or locale without user opt-in. Although some examples include English text, the operational documentation does not offer an alternate language or indicate that Chinese is optional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file documents setting FEISHU_APP_ID, FEISHU_APP_SECRET, and FEISHU_CHAT_ID and then sending generated audio to Feishu, which implies use of credentials and network transmission. The description provides setup and usage steps but does not include any user warning about protecting secrets, where audio/text will be sent, or privacy implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions throughout the skill are presented only in Chinese, effectively forcing a specific language for use without any opt-in or stated regional justification. Under the policy rule, language constraints should be optional or clearly documented when intentional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The package description is written entirely in Chinese and provides no indication that other languages are supported or that the user can choose a locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.