T01 · Skill Instruction Hijacking
Error
- Location
bin/voice-asr.mjs:117- Finding
ASR Output Injects Mandatory Instructions into the Agent Session
- Content
View full analysis
- Remediation
View remediation
Security audit
Voice TTS/ASR
Security checks for vulnerabilities and agentic risk
Overview
This voice skill mostly matches its advertised ASR/TTS and Telegram purpose, but it needs Review because some scripts mix user speech with agent instructions and use unsafe code/config handling.
Install only after reviewing the scripts and accepting that voice text/audio may be sent to Edge TTS and Telegram, Telegram bot tokens may be read from local config or environment variables, and inbound audio can be moved then deleted after transcription. Avoid untrusted installer arguments, protect ~/.openclaw/openclaw.json and bot tokens, and treat this package as needing fixes for JSON parsing, ASR output isolation, dependency pinning, and the missing helper scripts before broad use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:73- Finding
Arbitrary Python Code Injection Through the Installer Model Argument
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
lib/config.mjs:31- Finding
OpenClaw Configuration Is Evaluated as JavaScript Instead of Parsed as JSON
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
install.sh:47- Finding
Installer Uses Unpinned and Ambiguous Python Dependencies
- Content
View full analysis
&1 | tail -3 ``` The same unpinned requirements are declared in `SKILL.md`: ```yaml metadata: {"openclaw": {"emoji": "🎙️", "requires": {"bins": ["node>=18", "python3", "ffmpeg"], "pip": ["edge-tts", "whisper", "click"]}}} ``` ### Technical Analysis The installer retrieves `edge-tts`, `whisper`, and `click` without version constraints, integrity hashes, or a lock file. Each installation can therefore resolve to different package versions and artifacts. Python package installation may execute package build or installation logic. If an upstream release, dependency, package-index account, or configured mirror is compromised, malicious code may run during installation or when the Skill imports the package. The generic package name `whisper` is also ambiguous relative to the documented OpenAI Whisper functionality. Without a verified distribution identity and version, the installer may retrieve an unintended or incompatible project. The proxy option additionally changes the package index to a mirror. While use of a mirror is disclosed, no hash verification ensures that artifacts from the selected source match reviewed dependencies. ### Attack Path 1. A user runs `install.sh`. 2. The script requests mutable package names from PyPI or the configured mirror. 3. The package resolver selects the latest versions available at installation time. 4. A compromised, substituted, or unintended package is downloaded. 5. Package build or installation code runs with the privileges of the installing user. 6. Malicious runtime code may lat ...[truncated 661 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The stated purpose is ASR/TTS, but the documentation also instructs system package installation, model downloads, local file mutation, and external Telegram delivery without clearly framing those as privileged side effects. This mismatch can mislead users and orchestration layers into granting or triggering broader behavior than expected, especially where agent skills are trusted based on their declared description.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md agent 回复文字后，如需以语音发送，调用 `send_voice_reply.mjs` 手动发送 Telegram 语音消息：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md agent 回复文字后，如需以语音发送，调用 `send_voice_reply.mjs` 手动发送 Telegram 语音消息：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md agent 回复文字后，如需以语音发送，调用 `send_voice_reply.mjs` 手动发送 Telegram 语音消息：
Ssd 1
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script emits user-controlled transcription inside an imperative wrapper that instructs the downstream agent to obey the voice-tts workflow and call a specific tool. Because spoken input is attacker-controlled, this creates a semantic prompt-injection channel where untrusted content is delivered in-band with operational instructions, increasing the chance the agent will execute unintended actions or give the transcript elevated authority.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh TTS_OUT=$(node "$SKILL_DIR/bin/voice-tts.mjs" "安装测试" -f /tmp/tts-test.mp3 --agent main 2>&1) if [[ -f /tmp/tts-test.mp3 && -s /tmp/tts-test.mp3 ]]; then ok "TTS 生成验证通过 ✓" rm -f /tmp/tts-test.mp3 else warn "TTS 生成验证未通过，请检查 edge-tts 安装" fi
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documentation describes capabilities that require shell execution, environment access, package installation, file handling, and networked Telegram/TTS operations, but it declares no explicit tool scope or permissions boundary. In an agent ecosystem, this increases the chance that the skill is invoked with broader-than-expected privileges and that operators do not understand its effective access to local files, secrets, and external services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description says the skill fully replaces the built-in TTS tool for processing Chinese content, and later sections are centered on Chinese voices and prompts. This appears to impose a specific language/locale behavior without documenting user opt-in or an alternative language selection path.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill documents sending user-provided text through external services to generate and deliver Telegram voice messages, but it does not prominently warn that message content may leave the local environment. This can expose sensitive response content to third-party infrastructure or unintended recipients if users assume the skill is purely local.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
bash pip install edge-tts whisper click brew install ffmpeg # macOS sudo apt install -y ffmpeg # Ubuntu安装完成后运行冒烟测试：
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The sample configuration uses only
zh-CNvoices and a Chinese ASR initial prompt, which reinforces a fixed locale assumption. There is no accompanying note that these are defaults users may change for other languages, so the documentation reads as enforcing a single language setting.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation explains multiple token lookup paths, including config files and environment variables, but does not treat bot tokens as sensitive credentials requiring careful handling. In practice, this can encourage insecure storage, accidental logging, or overbroad access to messaging accounts if operators copy tokens into unsafe places.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill automatically copies inbound audio into an agent workspace and deletes the original after successful transcription, but this destructive behavior is not highlighted as a significant operational and privacy risk. Automatic file movement and deletion can cause data loss, break forensic traceability, or alter evidence without explicit operator approval.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md python3 -c "import whisper; print('whisper ok')" # 检查未处理语音文件 ls -la ~/.openclaw/media/inbound/ # 直接测试 ASR node bin/voice-asr.mjs ~/.openclaw/media/inbound/your-file.ogg
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The bulk-processing script scans and processes all unhandled inbound voice files, which goes beyond a narrow per-request voice conversion function and creates a broader surveillance or unintended data-processing capability. In multi-user or shared-agent environments, this can lead to over-collection and transcription of audio that was not explicitly selected for the current task.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes this skill as providing speech input via Whisper ASR and speech output via Edge TTS, but this file also copies inbound audio into an agent workspace and deletes the original file after successful transcription. Persisting and relocating user media is not an obvious implementation detail of transcription itself, so the code's behavior exceeds the described scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
After successful transcription, the script copies the input audio into a workspace directory and deletes the original file when it is under the inbound path. Although comments describe the behavior, there is no user-facing disclosure, confirmation prompt, or visible warning emitted before this destructive file operation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The generated voice message is hard-coded in Chinese and instructs downstream behavior using Chinese text, which imposes a specific language/locale regardless of user preference. There is no indication here that the user can choose the language or that the locale restriction is documented as intentional.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This manifest/config file sets the default voice to a zh-CN voice and provides a Chinese-only ASR initial prompt, which indicates the skill is configured to operate in a specific language by default. There is no accompanying indication in this file that users can choose another language or explicitly opt in, which matches the language/locale policy violation criteria.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh brew install ffmpeg 2>&1 | tail -3 else info "检测到 Linux，尝试用 apt 安装 ffmpeg..." sudo apt install -y ffmpeg 2>&1 | tail -3 fi ok "ffmpeg 安装完成 ✓" fi
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated OpenClaw config forces the ASR argument
--language zh, which constrains recognition to Chinese. This is a natural-language locale policy issue because the script does not present this as an opt-in choice or explain that the skill is intentionally limited to a Chinese-only deployment context.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The generated agent voice settings set all default voices to
zh-CN-*variants, enforcing a Chinese locale by default. Because the script does not offer a language/voice selection step or clearly justify a Chinese-only constraint, this creates a policy-relevant locale restriction.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code reads a global file from the user's home directory and evaluates its contents with vm.runInNewContext instead of parsing strict JSON. If an attacker can modify ~/.openclaw/openclaw.json, they can inject JavaScript that executes during config loading, turning a voice configuration feature into arbitrary code execution. The broader access to a cross-skill global config also increases the blast radius beyond this skill's stated purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code defines all user-facing error messages exclusively in Chinese, with no indication of locale selection, fallback options, or region-specific justification. That creates a natural-language policy issue because the skill appears to force a specific language without user opt-in.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The module comment states the fallback order is --token, then the current agent/default botToken from openclaw.json, then TELEGRAM_BOT_TOKEN. However, the implementation at L126-L128 gives precedence to the environment variable over openclaw.json by computing explicitToken as args.token || process.env.TELEGRAM_BOT_TOKEN and then using explicitToken || openclawToken. This is an active contradiction between documented intent and runtime behavior.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/voice-asr.mjs:60
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- bin/voice-tts.mjs:43
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/send_voice_reply.mjs:44