Lark (Feishu) Voice

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 0.1.2

Overview

This skill does what it claims by generating a voice file and sending it through Lark, with a minor local temporary-file safety issue to be aware of.

Install only if you are comfortable with the agent using a configured TTS source and the Lark message tool to send user-requested voice messages. Prefer updating the skill to use a unique private temporary directory per run and cleanup afterward before using it on multi-user or shared systems.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

Predictable Shared Temporary Files Permit Audio Substitution and File Overwrite

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–42
Vulnerability Type: Predictable and potentially shared temporary file usage
Risk Level: Medium

markdown

Call the selected TTS source to generate an audio file in wav/mp3 or other intermediate format, saved to `/tmp/openclaw/`.

### 3. Convert to Opus

Feishu voice messages only support the opus format (OGG container).

```bash
ffmpeg -y -i /tmp/openclaw/input.wav -c:a libopus -b:a 24k -ar 24000 -ac 1 /tmp/openclaw/voice.opus

text

### Technical Analysis

The skill directs every invocation to use fixed filenames, `/tmp/openclaw/input.wav` and `/tmp/openclaw/voice.opus`, under a temporary directory. It also invokes `ffmpeg` with `-y`, which unconditionally overwrites the output path.

Predictable shared paths introduce race conditions and filename collisions between concurrent skill executions. If another local process can write to `/tmp/openclaw`, it may pre-create or replace these paths, including with symbolic links. This could cause the skill to process attacker-selected input, overwrite a file reachable through a symbolic link, or send audio produced by another invocation.

The exploitability of symbolic-link attacks depends on the permissions and ownership of `/tmp/openclaw`, the privileges of the agent process, and operating-system protections. The document does not require a private directory, restrictive permissions, exclusive file creation, or symbolic-link checks.

### Attack Path

1. A local attacker identifies the documented fixed paths under `/tmp/openclaw`.
2. The attacker waits for or predicts a voice-generation operation.
3. The attacker creates or replaces `input.wav` with attacker-controlled audio, or creates `voice.opus` as a symbolic link to another path writable by the agent.
4. The skill executes `ffmpeg -y` using the predictable input and output paths.
5. The agent processes substituted input or overwrites the link ta
...[truncated 643 chars]

Remediation

View remediation

Remediation Suggestions

• Create a unique per-invocation directory using a secure facility such as mktemp -d.
• Set the directory permissions to 0700 and ensure it is owned by the agent account.
• Generate unpredictable input and output filenames rather than using global fixed names.
• Open output files with exclusive-creation and no-follow semantics where supported.
• Verify that source and destination files are regular files owned by the expected user before processing or sending them.
• Avoid unconditional ffmpeg -y overwrites unless the destination is inside a newly created private directory.
• Ensure concurrent invocations never share a workspace.
• Delete temporary audio and the per-invocation directory after sending, including cleanup on failure or cancellation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.