Feishu Voice Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:35 AM UTC
• Version: 1.2.0

Overview

This skill does what it claims: it turns text into audio with NoizAI and sends it as a Feishu voice message, but users should treat the transmitted text, audio, and credentials carefully.

Install only if you are comfortable sending message text to NoizAI and generated audio to Feishu. Use least-privilege Feishu bot permissions, keep FEISHU_APP_SECRET and NOIZ_API_KEY out of command history and source control, avoid sensitive or regulated content, pin or verify any npx installer, and be cautious with cron or batch sends.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:62
• Finding: Unpinned Package Download and Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `README.md:62` **Vulnerability Type**: Unpinned third-party package execution **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add feishu-voice-skill ``` ### Technical Analysis The installation documentation invokes the `skills` package through `npx` without specifying a version or integrity value. If the package is not already installed locally, `npx` can retrieve its current release from the configured package registry and execute its CLI code. Because the resolved package is mutable and its provenance is not verified by this project, the code executed by this command may differ from the code reviewed when the Skill was published. A registry compromise, maintainer-account compromise, or package takeover could therefore turn this documented installation command into a supply-chain execution vector. The command does not explicitly use administrative privileges. Consequently, any downloaded code would ordinarily execute with the permissions of the user running `npx`, rather than automatically obtaining root access. ### Attack Path 1. An attacker compromises the package registry entry, maintainer account, or release process for the unpinned `skills` package. 2. The attacker publishes a malicious version as the version selected by default. 3. A user follows the README and runs `npx skills add feishu-voice-skill`. 4. `npx` downloads and executes the attacker-controlled package version. 5. The malicious package can access files, credentials, environment variables, and network resources available to the invoking user. ### Impact Assessment Successful exploitation can provide arbitrary code execution under the invoking user's account. The accessible scope may include the user's files, ClawHub or npm credentials, environment variables, and other resources available to that account. If a user independently runs the documented command from a privileged shell, the downloaded code would inherit t ...[truncated 93 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the CLI to a reviewed version, for example `npx skills@<reviewed-version> add feishu-voice-skill`. - Verify and document the expected package publisher and registry. - Use package-lock or equivalent integrity metadata where the installation workflow supports it. - Prefer a locally installed, reviewed CLI invoked with `npx --no-install` so that installation and execution are separate trust decisions. - Document that the command must not be run with `sudo` or from an unnecessarily privileged account. - Establish an update process in which new CLI versions are reviewed before the documented version is changed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_voice.sh:146
• Finding: Unsafe JSON Construction from User-Controlled Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_voice.sh:146-154` **Vulnerability Type**: JSON injection and malformed request construction **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST "https://api.noiz.ai/tts" \ -H "Authorization: $NOIZ_API_KEY" \ -H "Content-Type: application/json" \ -d "{ \"text\": \"$TEXT\", \"speed\": $SPEED, \"emotion\": \"$EMOTION\" }" \ -o "$TEMP_MP3" ``` ### Technical Analysis The script constructs a JSON request by directly interpolating `TEXT`, `SPEED`, and `EMOTION` into a shell string. These values originate from command-line arguments or a user-selected text file and are not JSON-escaped or strictly validated. A text value containing quotation marks, backslashes, or control characters can terminate or alter the intended JSON string. Likewise, `SPEED` is inserted as a raw JSON token rather than as an encoded value, and `EMOTION` is inserted without an allowlist. This permits malformed requests and may permit insertion of additional JSON members, with the exact handling of duplicate or unexpected members depending on the remote API parser. This construction is not direct shell command injection because the expansions remain inside a quoted shell argument. The principal issue is injection into the JSON data structure sent to NoizAI. ### Attack Path 1. An attacker supplies or influences text passed through `-t`, or controls a file read through `-f`. 2. The supplied content includes JSON syntax, quotation marks, escape characters, or control characters. 3. The script interpolates that content into the request body without JSON encoding. 4. The resulting request is malformed or contains attacker-influenced JSON structure. 5. NoizAI rejects the request, interprets duplicate fields unexpectedly, or processes injected fields if its API accepts them. For example, a quotation mark in ordinary input is enough to break the intended JSON string. More carefully constructed ...[truncated 599 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Construct the request with a JSON-aware tool instead of string interpolation. For example: ```bash case "$EMOTION" in happy|sad|angry|neutral) ;; *) echo "Invalid emotion" >&2; exit 1 ;; esac if ! [[ "$SPEED" =~ ^(0\.5|0\.[6-9]|1(\.[0-9]+)?|2(\.0+)?)$ ]]; then echo "Invalid speed" >&2 exit 1 fi PAYLOAD=$(jq -n \ --arg text "$TEXT" \ --arg emotion "$EMOTION" \ --argjson speed "$SPEED" \ '{text: $text, speed: $speed, emotion: $emotion}') curl --fail-with-body --silent --show-error \ -X POST "https://api.noiz.ai/tts" \ -H "Authorization: $NOIZ_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD" \ -o "$TEMP_MP3" ``` - Enforce the documented numeric range of `0.5` through `2.0` for speed. - Allowlist the documented emotion values. - Set a reasonable maximum text length to limit accidental or attacker-induced API usage. - Use `curl --fail-with-body --silent --show-error` and validate the response status and content type before passing the result to FFmpeg. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Credential Access

High

• Category: Privilege Escalation

Content

## Feishu API 端点

### 1. 获取 Tenant Access Token

```bash
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

## Feishu API 端点

### 1. 获取 Tenant Access Token

```bash
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

echo -e "${BLUE}📤 上传到飞书...${NC}"

# 获取 Token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

fi

# 上传文件
UPLOAD_RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $TOKEN" \
  -F "type=audio" \
  -F "file=@$TEMP_OPUS" \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

echo -e "${BLUE}📤 发送语音消息...${NC}"

# 发送消息
RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The entire publishing guide is written only in Chinese and even suggests the tag "chinese" for the skill, which indicates a language-specific presentation without any stated opt-in, alternative locale, or justification. Under the policy, forcing a specific language without user choice can be a natural-language locale violation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to configure Feishu and NoizAI credentials and send synthesized voice through external APIs, but it does not clearly warn that message content and metadata will be transmitted to third-party services or explain how secrets should be protected. In a skill centered on external TTS and messaging, this omission increases the chance of accidental sensitive-data disclosure and unsafe credential handling by users.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documents shell-based behavior and instructs users to run local scripts, install packages, and export secrets, but it does not declare any tool scope such as permissions or allowed-tools. That omission weakens governance and makes it easier for an agent or user to invoke shell capabilities and handle credentials without clear boundaries, increasing the chance of unintended command execution or secret exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill is built around sending user-provided text to NoizAI for speech synthesis and then transmitting generated audio to Feishu, yet the documentation does not clearly disclose that message content leaves the local environment and is processed by third-party services. This creates a privacy and data-handling risk, especially if users submit sensitive text, personal data, or confidential business content under the assumption the processing is local.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The advanced usage section claims users can '使用参考音频克隆声音' and shows a `--ref-audio` option, but the earlier command parameter list does not define any `--ref-audio` flag. Within the provided skill documentation, this is an active mismatch between documented behavior and the declared interface, which can mislead users about what the skill actually does.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# 每天早上 8 点发送早安
crontab -e
# 添加：0 8 * * * /path/to/send_voice.sh -t "主人早上好～"
```

• Confidence: 85% confidence
• Finding: The cron example establishes persistent automated execution that will repeatedly send content using stored environment-based credentials. In agent or shared-host contexts, persistence increases risk because a misconfigured or compromised script can continue exfiltrating content, sending spam, or consuming credentials without ongoing user approval.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description is written as a Chinese-only capability statement, and the manifest metadata reinforces a Chinese-language focus via tags such as "chinese" and "飞书". There is no indication that users can opt into another language or that the locale restriction is explicitly justified as region-specific, which may violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The comments and spoken greeting are hard-coded in Chinese, and the script provides no option for the user to select a language or confirm that a Chinese-only interaction is intended. This is a natural-language policy issue because it enforces a specific language without opt-in or documented regional justification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation includes examples using highly sensitive credentials such as app_secret and API keys but does not warn readers that these values must be protected and never hardcoded, logged, or exposed. In an agent skill context, this omission can lead developers to handle secrets unsafely, increasing the chance of credential leakage and downstream compromise of Feishu or TTS accounts.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The documentation describes uploading audio files and sending messages to Feishu without clearly warning that user-provided content is transmitted to external services. This creates a privacy and data-governance risk because operators may unknowingly send sensitive voice data or message content off-system.

External Transmission

Medium

• Category: Data Exfiltration

Content

### 生成语音

```bash
POST https://api.noiz.ai/tts

Headers:
  Authorization: <NOIZ_API_KEY>

• Confidence: 86% confidence
• Finding: The skill references an external TTS endpoint at api.noiz.ai, meaning user text submitted for speech generation leaves the local environment and is processed by a third party. In this skill's context that behavior is expected, but the absence of an explicit warning and data-handling guidance makes it a real external transmission risk rather than a harmless mention.

External Transmission

Medium

• Category: Data Exfiltration

Content

# 使用已安装的 tts.sh
    tts.sh speak -t "$TEXT" --backend noiz -o "$TEMP_MP3" 2>&1 | tail -3
else
    # 使用 curl 调用 NoizAI API
    echo -e "${YELLOW}⚠️  未找到 tts.sh，使用 curl 调用 NoizAI API...${NC}"
    curl -s -X POST "https://api.noiz.ai/tts" \
      -H "Authorization: $NOIZ_API_KEY" \

• Confidence: 90% confidence
• Finding: This code transmits user-supplied text to an external TTS provider, which is an intentional feature, but it still represents a real data-exposure boundary. In a messaging skill, that context makes the transmission expected, yet it remains dangerous if sensitive content is passed without strong notice, consent, or data minimization.

External Transmission

Medium

• Category: Data Exfiltration

Content

else
    # 使用 curl 调用 NoizAI API
    echo -e "${YELLOW}⚠️  未找到 tts.sh，使用 curl 调用 NoizAI API...${NC}"
    curl -s -X POST "https://api.noiz.ai/tts" \
      -H "Authorization: $NOIZ_API_KEY" \
      -H "Content-Type: application/json" \
      -d "{

• Confidence: 90% confidence
• Finding: The hardcoded NoizAI endpoint confirms the script sends content off-host to a third-party service. In this skill context that is expected behavior, but it is still a genuine privacy/security concern because message text may include confidential information and there is no strong disclosure or policy control in the script.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script sends the full user-provided text to the external NoizAI TTS service, but the interface does not clearly disclose that message contents leave the local machine and are processed by a third party. This creates a privacy and data-handling risk, especially if users supply sensitive or confidential text under the assumption that conversion is local.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo -e "${BLUE}📤 上传到飞书...${NC}"

# 获取 Token
TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated audio is uploaded to Feishu and then sent into a chat, but the script does not prominently warn the user that content will be transferred to an external messaging platform. Users may unintentionally disclose private material because the script's UX emphasizes functionality rather than consent and disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo -e "${BLUE}📤 发送语音消息...${NC}"

# 发送消息
RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

• Confidence: 88% confidence
• Finding: Sending the audio message to Feishu is the intended function of the skill, but it still constitutes external transmission of user content to a third-party platform. The risk is primarily privacy and accidental disclosure when operators may not realize the destination or sensitivity of the uploaded material.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The natural-language instructions, examples, and usage are entirely Chinese-focused, including all sample messages and operational guidance, with no indication that users may choose another language. Under the stated policy, forcing a specific language or locale without opt-in can be a violation unless clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The manifest uses Chinese-only natural-language description and includes a `chinese` tag, which signals a language-specific skill experience without offering any user choice or documenting why the locale restriction is required. Under the policy rule for natural-language violations, this can be considered a language/locale constraint imposed without opt-in.

Static analysis

No suspicious patterns detected.