ClawHub
Back to skill

Security audit

SenseAudio Podcast Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real podcast generator, but it can automatically upload generated audio to a hard-coded Feishu cloud folder using local OpenClaw credentials without clear user control.

Install only after reviewing and constraining the Feishu upload behavior. Require an explicit user-selected cloud folder, disable IM sending by default, avoid using central OpenClaw credentials unless needed, and do not run the included tests against production credentials or live services.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/generate.py:65
Finding

Automatic Upload of User-Generated Audio to a Hard-Coded Feishu Test Folder

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/generate.py:21
Finding

Excessive Access to the Central OpenClaw Credential Configuration

Content
View full analysis
Dict[str, Any]: if not OPENCLAW_CONFIG.exists(): return {"senseaudio_api_key": "", "gateway_token": ""} with open(OPENCLAW_CONFIG) as f: config = json.load(f) gateway_token = config.get("gateway", {}).get("auth", {}).get("token", "") global OPENCLAW_TOKEN OPENCLAW_TOKEN = gateway_token return { "senseaudio_api_key": config.get("env", {}).get("SENSEAUDIO_API_KEY", ""), "gateway_token": gateway_token, "llm_provider": "bailian", "llm_model": "qwen3.5-plus", } ``` The upload path reopens the same central configuration to retrieve additional channel credentials: ```python with open(OPENCLAW_CONFIG) as f: config = json.load(f) feishu_config = config['channels']['feishu']['accounts']['new-channel'] app_id = feishu_config['appId'] app_secret = feishu_config['appSecret'] ``` ### Technical Analysis The Skill metadata declares `SENSEAUDIO_API_KEY` as its required environment variable, but the implementation reads the complete `~/.openclaw/openclaw.json` file. That central file may contain authentication material for multiple channels and services. The script extracts the OpenClaw gateway token during every configuration load, even though the implemented `openclaw message send` subprocess does not use the token directly. It later reads a fixed Feishu account entry and extracts its application secret when cloud upload is selected. This expands the sensitive-data boundary beyond the minimum required for podcast generation. Loading the entire configuration also creates a high-value credential access point: any future code execution flaw or ...[truncated 1622 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
tests/test_skill.py:96
Finding

Test Suite Performs Real Network, Billing, Storage, and Process Side Effects

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/server.py:25
Finding

Predictable Temporary PID and Log Files Allow Local File and Process Tampering

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (48)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill scope appears broader than advertised because it implies service lifecycle management, signal-based process control, local HTTP status checks, and PID/log file handling in addition to audio generation. Even if these are operational features, they introduce execution and host-control behaviors that can affect the local system and should not be hidden behind a benign media-generation description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill scope appears broader than advertised because it implies service lifecycle management, signal-based process control, local HTTP status checks, and PID/log file handling in addition to audio generation. Even if these are operational features, they introduce execution and host-control behaviors that can affect the local system and should not be hidden behind a benign media-generation description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Voice cloning and uploaded audio samples are highly sensitive biometric data, yet the skill does not present any privacy warning, consent guidance, or retention/usage disclosure for this feature. In this context, omission is especially dangerous because users may unknowingly provide recordings of themselves or others that can later be misused for impersonation or identity abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This function uploads generated audio to Feishu cloud drive using locally sourced app credentials, a capability not described in the manifest. In the context of a podcast generator, silent cloud upload is a significant data-exfiltration behavior because generated content may include sensitive user-provided topics or proprietary material.

Content

No source excerpt is available for this finding.

Tainted flow: 'headers' from open (line 100, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
95% confidence
Finding

The code reads Feishu credentials from local OpenClaw configuration and uses them to upload the generated audio file to an external cloud-drive endpoint. This creates an undisclosed external data transfer path using unrelated credentials, which is dangerous in an agent skill because user content leaves the local environment automatically.

Content

Scanner excerpt · scripts/generate.py (reported line 105)May include surrounding context.

python
'Content-Type': multi_form.content_type
    }
    
    upload_response = requests.post(
        'https://open.feishu.cn/open-apis/drive/v1/files/upload_all',
        headers=headers,
        data=multi_form

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends generated audio into IM conversations by invoking an external CLI with runtime chat context, which exceeds the declared purpose of content generation. In an agent setting this can disclose generated content to third parties or active chats without the user's informed approval.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares significant capabilities—environment variable access, shell execution, file I/O, and network use—but does not scope or restrict them via an explicit permissions/allowed-tools declaration. That makes the skill harder to audit and increases the chance an agent runtime grants broader access than users expect, especially since the workflow includes process launching, local server startup, and uploads to external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Trigger phrases like '生成播客', '播客', and '启动播客' are broad and likely to overlap with normal conversation, increasing the risk of accidental activation. Because activation can lead to starting a local web server and opening a browser, an unintended match has side effects beyond a simple text response.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The IM-mode activation rules are ambiguous because they allow automatic mode selection based on channel and loosely defined user phrasing. In practice, this can cause the agent to process and transmit user content to external services without a sufficiently explicit request for that mode, especially in chat environments where messages are brief and contextual.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes generation and channel delivery flows but does not warn users that their topic text or script content will be transmitted to external TTS/LLM providers and possibly cloud storage. This is a privacy and data-handling issue because users may paste sensitive material under the assumption processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

文件标题及整篇面向 Agent 的操作说明均以中文固定呈现，没有说明可根据用户偏好切换语言，也未提供语言选项。按规则，若技能强制特定语言而无用户 opt-in，属于自然语言层面的政策风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/AGENT.md (reported line 26)May include surrounding context.

python3 /home/wang/桌面/龙虾工作区/podcast-generator/backend/app.py

检查服务状态

curl http://localhost:5000/api/config

text

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/AGENT.md (reported line 112)May include surrounding context.

md
API_KEY = "sk-xxx"  # 用户提供的 SenseAudio API Key

# 生成播客
response = requests.post(
    f"{API_BASE}/api/generate",
    headers={
        "Content-Type": "application/json",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill reads OpenClaw gateway tokens, Feishu-related configuration, and runtime messaging context that are not necessary for core podcast generation. Accessing unrelated credentials and conversation context broadens privilege unnecessarily and makes later exfiltration features more dangerous.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
75% confidence
Finding

This duplicate finding reflects the same external transmission of Feishu application credentials to the official Feishu auth API. The transmission itself is expected for OAuth-style token retrieval, but it remains sensitive and scope-expanding for this skill.

Content

Scanner excerpt · scripts/generate.py (reported line 81)May include surrounding context.

python
app_secret = feishu_config['appSecret']
    
    # 获取 token
    token_response = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This duplicate finding reflects the same external transmission of Feishu application credentials to the official Feishu auth API. The transmission itself is expected for OAuth-style token retrieval, but it remains sensitive and scope-expanding for this skill.

Content

Scanner excerpt · scripts/generate.py (reported line 81)May include surrounding context.

python
app_secret = feishu_config['appSecret']
    
    # 获取 token
    token_response = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': app_id, 'app_secret': app_secret}
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This outbound request uploads the generated audio file to Feishu cloud storage, transmitting user-derived content externally. In the context of a podcast generator, that is a substantial confidentiality risk because content leaves the local machine without being central to generation itself.

Content

Scanner excerpt · scripts/generate.py (reported line 105)May include surrounding context.

python
'Content-Type': multi_form.content_type
    }
    
    upload_response = requests.post(
        'https://open.feishu.cn/open-apis/drive/v1/files/upload_all',
        headers=headers,
        data=multi_form

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 153)May include surrounding context.

python
opus_path = mp3_path.replace('.mp3', '.opus')
    
    # FFmpeg 转换
    result = subprocess.run(
        [
            'ffmpeg', '-i', mp3_path,
            '-acodec', 'libopus', '-ac', '1', '-ar', '16000',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

Although subprocess.run is used safely with an argument array, this code causes the skill to invoke an external messaging CLI and send files/messages into IM conversations using runtime-derived context. That is a real capability expansion and data-exfiltration risk in this skill context, even if it is not classic shell injection.

Content

Scanner excerpt · scripts/generate.py (reported line 221)May include surrounding context.

python
# 发送音频文件
        # 使用 message 工具 API
        result = subprocess.run(
            [
                "openclaw", "message", "send",
                "--channel", channel or "feishu",

Tainted flow: 'chat_id' from os.getenv (line 204, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate.py (reported line 221)May include surrounding context.

python
# 发送音频文件
        # 使用 message 工具 API
        result = subprocess.run(
            [
                "openclaw", "message", "send",
                "--channel", channel or "feishu",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

Automatically starting a backend Flask service is a hidden operational capability that changes the host's running state and may expose a local API. For a user expecting a simple script, this behavior increases persistence and attack surface beyond the documented scope.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
86% confidence
Finding

The script can automatically start another local service process without explicit user consent, expanding its behavior beyond simple podcast generation. In an agent environment, spawning background services increases attack surface and may execute unreviewed code paths from the local project tree.

Content

Scanner excerpt · scripts/generate.py (reported line 267)May include surrounding context.

python
return True
    
    # 启动 Flask
    process = subprocess.Popen(
        ["python3", str(PROJECT_DIR / "backend" / "app.py")],
        stdout=subprocess.DEVNULL,
        stderr=subprocess.DEVNULL,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 340)May include surrounding context.

python
try:
        # 调用 API
        response = requests.post(
            f"{API_BASE}/api/generate",
            headers={
                "Content-Type": "application/json",

Tainted flow: 'download_url' from requests.post (line 359, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate.py (reported line 360)May include surrounding context.

python
# 下载音频文件
        download_url = f"{API_BASE}{data['download_url']}"
        audio_response = requests.get(download_url, timeout=30)
        
        if audio_response.status_code != 200:
            return {

Tainted flow: 'audio_path' from requests.post (line 374, network input) → open (file write)

Medium
Category
Data Flow
Confidence
90% confidence
Finding

When no explicit output path is supplied, the script writes to PROJECT_DIR/output combined with data['output_file'] received from the API response. If the local service is compromised or returns a crafted filename containing traversal sequences, this can overwrite arbitrary files writable by the user.

Content

Scanner excerpt · scripts/generate.py (reported line 377)May include surrounding context.

python
audio_path = output_dir / data["output_file"]
        
        audio_path.parent.mkdir(parents=True, exist_ok=True)
        with open(audio_path, "wb") as f:
            f.write(audio_response.content)
        
        result = {

Static analysis

No suspicious patterns detected.