Security audit

Feishu Voice Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it turns text into audio with NoizAI and sends it as a Feishu voice message, but users should treat the transmitted text, audio, and credentials carefully.

Install only if you are comfortable sending message text to NoizAI and generated audio to Feishu. Use least-privilege Feishu bot permissions, keep FEISHU_APP_SECRET and NOIZ_API_KEY out of command history and source control, avoid sensitive or regulated content, pin or verify any npx installer, and be cautious with cron or batch sends.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:62
Finding: Unpinned Package Download and Execution Through npx
Content: View full analysis
Remediation: View remediation
add feishu-voice-skill`. - Verify and document the expected package publisher and registry. - Use package-lock or equivalent integrity metadata where the installation workflow supports it. - Prefer a locally installed, reviewed CLI invoked with `npx --no-install` so that installation and execution are separate trust decisions. - Document that the command must not be run with `sudo` or from an unnecessarily privileged account. - Establish an update process in which new CLI versions are reviewed before the documented version is changed. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send_voice.sh:146
Finding: Unsafe JSON Construction from User-Controlled Arguments
Content: View full analysis
Remediation: View remediation
&2; exit 1 ;; esac if ! [[ "$SPEED" =~ ^(0\.5|0\.[6-9]|1(\.[0-9]+)?|2(\.0+)?)$ ]]; then echo "Invalid speed" >&2 exit 1 fi PAYLOAD=$(jq -n \ --arg text "$TEXT" \ --arg emotion "$EMOTION" \ --argjson speed "$SPEED" \ '{text: $text, speed: $speed, emotion: $emotion}') curl --fail-with-body --silent --show-error \ -X POST "https://api.noiz.ai/tts" \ -H "Authorization: $NOIZ_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD" \ -o "$TEMP_MP3" ``` - Enforce the documented numeric range of `0.5` through `2.0` for speed. - Allowlist the documented emotion values. - Set a reasonable maximum text length to limit accidental or attacker-induced API usage. - Use `curl --fail-with-body --silent --show-error` and validate the response status and content type before passing the result to FFmpeg. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence

Findings (26)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · reference.md (reported line 5)May include surrounding context.
Feishu API 端点

1. 获取 Tenant Access Token

bash
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · reference.md (reported line 112)May include surrounding context.
Feishu API 端点

1. 获取 Tenant Access Token

bash
POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 193)May include surrounding context.
sh
echo -e "${BLUE}📤 上传到飞书...${NC}" # 获取 Token TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 205)May include surrounding context.
sh
fi # 上传文件 UPLOAD_RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $TOKEN" \ -F "type=audio" \ -F "file=@$TEMP_OPUS" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 229)May include surrounding context.
sh
echo -e "${BLUE}📤 发送语音消息...${NC}" # 发送消息 RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire publishing guide is written only in Chinese and even suggests the tag "chinese" for the skill, which indicates a language-specific presentation without any stated opt-in, alternative locale, or justification. Under the policy, forcing a specific language without user choice can be a natural-language locale violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to configure Feishu and NoizAI credentials and send synthesized voice through external APIs, but it does not clearly warn that message content and metadata will be transmitted to third-party services or explain how secrets should be protected. In a skill centered on external TTS and messaging, this omission increases the chance of accidental sensitive-data disclosure and unsafe credential handling by users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents shell-based behavior and instructs users to run local scripts, install packages, and export secrets, but it does not declare any tool scope such as permissions or allowed-tools. That omission weakens governance and makes it easier for an agent or user to invoke shell capabilities and handle credentials without clear boundaries, increasing the chance of unintended command execution or secret exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is built around sending user-provided text to NoizAI for speech synthesis and then transmitting generated audio to Feishu, yet the documentation does not clearly disclose that message content leaves the local environment and is processed by third-party services. This creates a privacy and data-handling risk, especially if users submit sensitive text, personal data, or confidential business content under the assumption the processing is local.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The advanced usage section claims users can '使用参考音频克隆声音' and shows a --ref-audio option, but the earlier command parameter list does not define any --ref-audio flag. Within the provided skill documentation, this is an active mismatch between documented behavior and the declared interface, which can mislead users about what the skill actually does.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The cron example establishes persistent automated execution that will repeatedly send content using stored environment-based credentials. In agent or shared-host contexts, persistence increases risk because a misconfigured or compromised script can continue exfiltrating content, sending spam, or consuming credentials without ongoing user approval.
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
bash
# 每天早上 8 点发送早安 crontab -e # 添加：0 8 * * * /path/to/send_voice.sh -t "主人早上好～"

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description is written as a Chinese-only capability statement, and the manifest metadata reinforces a Chinese-language focus via tags such as "chinese" and "飞书". There is no indication that users can opt into another language or that the locale restriction is explicitly justified as region-specific, which may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comments and spoken greeting are hard-coded in Chinese, and the script provides no option for the user to select a language or confirm that a Chinese-only interaction is intended. This is a natural-language policy issue because it enforces a specific language without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation includes examples using highly sensitive credentials such as app_secret and API keys but does not warn readers that these values must be protected and never hardcoded, logged, or exposed. In an agent skill context, this omission can lead developers to handle secrets unsafely, increasing the chance of credential leakage and downstream compromise of Feishu or TTS accounts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The documentation describes uploading audio files and sending messages to Feishu without clearly warning that user-provided content is transmitted to external services. This creates a privacy and data-governance risk because operators may unknowingly send sensitive voice data or message content off-system.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The skill references an external TTS endpoint at api.noiz.ai, meaning user text submitted for speech generation leaves the local environment and is processed by a third party. In this skill's context that behavior is expected, but the absence of an explicit warning and data-handling guidance makes it a real external transmission risk rather than a harmless mention.
Content: Scanner excerpt · reference.md (reported line 80)May include surrounding context.
生成语音

bash
POST https://api.noiz.ai/tts Headers: Authorization: <NOIZ_API_KEY>

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This code transmits user-supplied text to an external TTS provider, which is an intentional feature, but it still represents a real data-exposure boundary. In a messaging skill, that context makes the transmission expected, yet it remains dangerous if sensitive content is passed without strong notice, consent, or data minimization.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 144)May include surrounding context.
sh
# 使用已安装的 tts.sh tts.sh speak -t "$TEXT" --backend noiz -o "$TEMP_MP3" 2>&1 | tail -3 else # 使用 curl 调用 NoizAI API echo -e "${YELLOW}⚠️ 未找到 tts.sh，使用 curl 调用 NoizAI API...${NC}" curl -s -X POST "https://api.noiz.ai/tts" \ -H "Authorization: $NOIZ_API_KEY" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The hardcoded NoizAI endpoint confirms the script sends content off-host to a third-party service. In this skill context that is expected behavior, but it is still a genuine privacy/security concern because message text may include confidential information and there is no strong disclosure or policy control in the script.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 146)May include surrounding context.
sh
else # 使用 curl 调用 NoizAI API echo -e "${YELLOW}⚠️ 未找到 tts.sh，使用 curl 调用 NoizAI API...${NC}" curl -s -X POST "https://api.noiz.ai/tts" \ -H "Authorization: $NOIZ_API_KEY" \ -H "Content-Type: application/json" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends the full user-provided text to the external NoizAI TTS service, but the interface does not clearly disclose that message contents leave the local machine and are processed by a third party. This creates a privacy and data-handling risk, especially if users supply sensitive or confidential text under the assumption that conversion is local.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 193)May include surrounding context.
sh
echo -e "${BLUE}📤 上传到飞书...${NC}" # 获取 Token TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated audio is uploaded to Feishu and then sent into a chat, but the script does not prominently warn the user that content will be transferred to an external messaging platform. Users may unintentionally disclose private material because the script's UX emphasizes functionality rather than consent and disclosure.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: Sending the audio message to Feishu is the intended function of the skill, but it still constitutes external transmission of user content to a third-party platform. The risk is primarily privacy and accidental disclosure when operators may not realize the destination or sensitivity of the uploaded material.
Content: Scanner excerpt · scripts/send_voice.sh (reported line 229)May include surrounding context.
sh
echo -e "${BLUE}📤 发送语音消息...${NC}" # 发送消息 RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$FEISHU_CHAT_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\",\\\"duration\\\":$DURATION_MS}\"}")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The natural-language instructions, examples, and usage are entirely Chinese-focused, including all sample messages and operational guidance, with no indication that users may choose another language. Under the stated policy, forcing a specific language or locale without opt-in can be a violation unless clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest uses Chinese-only natural-language description and includes a chinese tag, which signals a language-specific skill experience without offering any user choice or documenting why the locale restriction is required. Under the policy rule for natural-language violations, this can be considered a language/locale constraint imposed without opt-in.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

Feishu API 端点

1. 获取 Tenant Access Token

Credential Access

Feishu API 端点

1. 获取 Tenant Access Token

External Script Fetching

External Script Fetching

External Script Fetching

Natural-Language Policy Violations

Missing User Warnings

Rp1

Undeclared Tool Scope

Missing User Warnings

Intent-Code Divergence

Session Persistence

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Missing User Warnings

External Transmission

生成语音

External Transmission

External Transmission

Missing User Warnings

External Transmission

Missing User Warnings

External Transmission

Natural-Language Policy Violations

Natural-Language Policy Violations