Murasame Feishu Voice

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:00 AM UTC
• Version: 0.1.0

Overview

This skill mostly matches its stated Feishu voice-message purpose, but it has hidden plaintext message logging and executes an unaudited sibling sender with the full environment.

Review this skill before installing. Remove or disable the plaintext debug write, avoid passing the full environment to child processes, and bundle or verify the Feishu voice sender instead of trusting a sibling file. Also confirm the Feishu app permissions, receiver OpenID, and fixed Windows workspace paths are appropriate for your environment.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_text.py:54

Finding

Persistent Plaintext Storage of Private Message Content

Content

View full analysis

Vulnerability Details

File Location: scripts/send_text.py, lines 54–59
Vulnerability Type: Plaintext sensitive-data persistence
Risk Level: Medium

Vulnerable Code

python

# debug
try:
    Path(r"C:\Users\chenxun\.nanobot\workspace\murasame_text_debug.txt").write_text(repr(text), encoding="utf-8")
except Exception:
    pass

Technical Analysis

The script writes every processed message to a fixed plaintext debug file before transmitting the message to Feishu. Message text may contain private conversations, credentials, personal information, or other sensitive content.

This write is not required for the Skill's declared text-and-voice messaging functionality. The file is created without an explicit restrictive permission mode, encryption, retention limit, or user-controlled diagnostic setting. Reusing a fixed path also leaves the most recently processed message available after the sending operation has completed.

The broad exception handler suppresses all write failures, making the logging behavior difficult for users and operators to observe or audit.

Attack Path

1. A user submits sensitive text to the Skill.
2. send_text.py stores repr(text) in murasame_text_debug.txt.
3. The plaintext remains in the workspace after the message is sent.
4. A local user or process with read access to that workspace opens the file.
5. The actor obtains the most recently logged message content without accessing Feishu.

Impact Assessment

Exploitation requires local read access to the configured workspace or an equivalent compromise of the user account. It does not directly grant elevated system privileges.

Successful exploitation discloses the most recently processed message and may expose personal data, confidential conversation content, tokens pasted into a message, or other application secrets. The scope is limited by the fixed file being overwritten, but filesystem backups, sn ...[truncated 56 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the debug file write because it is not necessary for message delivery.
2. If diagnostics are operationally required, make them explicitly opt-in through a disabled-by-default setting.
3. Do not log message bodies. Record only non-sensitive metadata such as a request identifier, message length, or success status.
4. Apply restrictive filesystem permissions and a short retention policy to any unavoidable diagnostic files.
5. Report diagnostic failures through controlled error handling rather than silently suppressing every exception.
6. Delete existing copies of murasame_text_debug.txt and review backups or snapshots according to the applicable data-retention policy.

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/send_murasame_voice.py:242

Finding

Unverified External Sender Execution with Full Environment Inheritance

Content

View full analysis

Vulnerability Details

File Location: scripts/send_murasame_voice.py, lines 242–268
Vulnerability Type: External tool hijacking and excessive secret exposure
Risk Level: Medium

Vulnerable Code

python

# Delegate sending to feishu-voice sender (proven working)
sender_script = Path(__file__).parent.parent.parent / "feishu-voice" / "scripts" / "send_voice_file.py"
if not sender_script.exists():
    raise SystemExit(f"Missing sender script: {sender_script}")

receiver = (receiver or "").strip()

# Always pass receiver via env
env = os.environ.copy()
env["FEISHU_RECEIVER"] = receiver

# 1) send text first (reduce perceived delay)
text_sender = Path(__file__).parent.parent / "scripts" / "send_text.py"
if text_sender.exists():
    env["MURASAME_TEXT"] = body
    run_cmd([
        sys.executable,
        str(text_sender),
        "_",
    ], env=env)

# 2) send voice (async)
subprocess.Popen([
    sys.executable,
    str(sender_script),
    str(audio_path),
], env=env)

Technical Analysis

Voice delivery executes send_voice_file.py from a sibling directory outside the audited Skill package. The code verifies only that the path exists; it does not verify ownership, permissions, provenance, or a cryptographic digest. Consequently, a file placed or modified at that location is treated as a trusted sender and executed by the current Python interpreter.

The subprocess receives os.environ.copy(), which exposes the entire parent environment rather than only the values required for voice delivery. Based on the documented configuration, this environment can include FEISHU_APP_ID, FEISHU_APP_SECRET, and FEISHU_RECEIVER. It may also contain unrelated credentials inherited from the Agent runtime.

Delegating voice delivery is consistent with the declared functionality, but executing mutable, unaudited code with the complete environment exceeds minimum privilege. The projec ...[truncated 1465 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle the voice-sending implementation inside the audited Skill package and review it as part of the same release.
2. Prefer calling the existing in-package Feishu upload and send functions instead of executing an external Python file.
3. If an external sender is unavoidable, install it in a protected, administrator-controlled location and verify its cryptographic digest before every execution.
4. Validate file ownership and permissions and reject sender files writable by untrusted users or processes.
5. Replace os.environ.copy() with a minimal environment allowlist containing only the variables strictly required by the child process.
6. Avoid passing unrelated credentials to either child process. Separate text and voice credentials if their required API permissions differ.
7. Pin and document the expected external component version and fail closed when its integrity cannot be established.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description centers on a voice-bubble/voice-message skill with Murasame voice pack support, tag-driven voice output, synchronized Chinese text, and fallback/control features. The actual code is a simple Feishu text sender: it reads text input, authenticates with Feishu using app credentials, and sends a text message to a receiver. This is a materially different primary purpose from voice delivery. The only overlap is that it sends Chinese-capable text to Feishu, but there is no audio handling, no voice bubble API usage, no tag logic, and no fallback/control implementation in the provided chunk. Additionally, it writes a local debug file, which is not reflected in the description. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

Copying the full process environment and passing it to child sender scripts broadens secret exposure beyond what is needed for this task. If the child script, its dependencies, or logs are compromised, unrelated credentials in the parent environment may be accessed or leaked, and the skill context makes this more concerning because it launches additional scripts to perform networked message delivery.

Content

Scanner excerpt · scripts/send_murasame_voice.py (reported line 251)May include surrounding context.

python

receiver = (receiver or "").strip()

    # Always pass receiver via env
    env = os.environ.copy()
    env["FEISHU_RECEIVER"] = receiver

    # 1) send text first (reduce perceived delay)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that require access to environment variables, filesystem, shell tools, and network services, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an overbroad and opaque trust boundary: an agent runtime may grant more access than users expect, increasing the risk of unintended credential use, file modification, or outbound requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description states that the skill will '同步发送中文文本', indicating the skill always sends Chinese text alongside voice output. This is a language-policy constraint expressed in natural language, and the file does not indicate that the user can choose another language or opt in to Chinese-only behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_murasame_voice.py (reported line 47)May include surrounding context.

python

def run_cmd(cmd, env=None):
    res = subprocess.run(cmd, capture_output=True, text=True, env=env)
    if res.returncode != 0:
        raise RuntimeError(res.stderr.strip() or res.stdout.strip())
    return res.stdout.strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script requires FEISHU_RECEIVER from the environment and uses it to direct outgoing messages, which is a sensitive messaging identifier. There is no confirmation prompt, warning comment, or user-facing disclosure explaining that the script will use this recipient value to send content externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends a plain text message before sending the voice clip, which exceeds a voice-only or voice-bubble-focused behavior and can disclose more content than users expect. In a messaging skill, silently broadening output channels increases privacy and consent risk because the text body may contain sensitive information that the user intended to express only via canned audio.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill delegates message sending to other scripts via subprocess without clear user disclosure, which increases the attack surface and makes actual behavior less transparent. In this context, chaining text and voice senders can cause unexpected outbound communications and complicates auditing of what data each subprocess may access.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_murasame_voice.py (reported line 265)May include surrounding context.

python

], env=env)

    # 2) send voice (async)
    subprocess.Popen([
        sys.executable,
        str(sender_script),
        str(audio_path),

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a Feishu voice-bubble skill that sends audio using the Murasame voice pack and, when applicable, synchronizes Chinese text alongside that voice flow. This file implements a generic text-only Feishu message sender as a primary behavior, with no voice generation, label handling, switch control, tag mapping, or keyword fallback logic present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function transmits message content and a recipient identifier to the Feishu messaging API. While sending a message is likely the skill's purpose, this file itself provides no docstring, comment, or other user-facing disclosure that input text and receiver data are sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

User-provided text is written to a local file without notice, consent, or minimization. This can leak private message contents to disk unexpectedly, increasing the risk of confidentiality loss if the host is shared, compromised, or routinely backed up.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest focuses on sending Feishu voice bubbles with tag mapping and fallback behavior. This script additionally persists an on/off state in a workspace file, introducing local configuration mutation beyond the core act of selecting and sending voice content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script writes the processed message text to a local plaintext debug file under a user profile directory. If messages contain sensitive content, this creates an unnecessary at-rest data exposure path that may persist beyond the send operation and be accessible to other local users, backup systems, or forensic collection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.