T08 · Insecure Dependencies
Warning
- Location
SKILL.md:12- Finding
Unpinned Global Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Voice (ElevenLabs)
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent Feishu voice-messaging purpose, but it needs review because it can send bot messages and route private audio/text through external services without strong opt-in or scoping controls.
Install only if you are comfortable with Feishu bot-send permissions and with voice/text content being sent to ElevenLabs. Use least-privileged Feishu app credentials, avoid shared hosts where process arguments may be visible, pin and verify the sag dependency, and require explicit user confirmation before enabling any smart or automatic reply flow.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/feishu-voice-send.sh:48- Finding
Unsafe Construction of Feishu JSON and Query Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/feishu-voice-send.sh:48- Finding
Feishu Application Secret Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied script accurately implements one subset of the description: sending a Feishu voice message using ElevenLabs-style TTS output and Feishu messaging APIs. However, the declared purpose also claims receiving Feishu audio messages, transcribing .ogg/.opus attachments with STT, and supporting smart reply logic that auto-replies differently based on message type. None of those behaviors appear in this code chunk. There is no inbound event handling, no STT/transcription, and no reply automation. This is therefore a description-to-code mismatch because the declared functionality is materially broader than the actual behavior shown.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broader Feishu voice messaging skill with both STT and TTS plus smart reply behavior. The actual code is narrowly scoped to transcription of a supplied audio file via ElevenLabs STT. While STT is part of the declared functionality, the code chunk lacks the central Feishu integration and all reply/sending features described. This is a material description-behavior mismatch rather than a mere partial implementation detail.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh [ -z "$DURATION" ] && DURATION=1 # Step 4: Get tenant_access_token TOKEN=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # Step 5: Upload opus FILE_KEY=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/im/v1/files' \ -H "Authorization: Bearer $TOKEN" \ -F 'file_type=opus' \ -F 'file_name=voice.opus' \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])") # Step 6: Send audio message RESULT=$(curl -sf -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh [ ! -f "$AUDIO_FILE" ] && echo "ERROR: File not found: $AUDIO_FILE" >&2 && exit 1 RESULT=$(curl -sf "https://api.elevenlabs.io/v1/speech-to-text" \ -H "xi-api-key: $ELEVENLABS_API_KEY" \ -F "model_id=scribe_v1" \ -F "file=@$AUDIO_FILE")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill instructs use of shell commands and external scripts but does not declare any tool scope or allowed-tools restrictions. In an agent environment, this can cause overbroad execution capability, making it easier for the skill to access local files, invoke networked CLIs, or handle secrets without explicit approval boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill processes voice data and transcriptions through ElevenLabs, but the description does not clearly warn users that message content leaves the local/Feishu environment and is sent to a third party. This creates a privacy and compliance risk because users may unknowingly transmit sensitive audio, identities, or message content to an external processor.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill advertises a smart reply mode that may automatically send messages on the user's behalf, but it does not prominently warn about that behavior or require opt-in confirmation. In a messaging context, automatic outbound replies can cause unintended disclosures, impersonation-like effects, or reputational harm if triggered on sensitive conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script sends the input text to ElevenLabs for TTS generation and posts Feishu credentials to obtain an access token, but it suppresses command output and provides no prompt, print statement, or explicit warning beyond terse usage comments. For a code file handling network transmission of user content and secrets, the absence of visible disclosure means users may not realize their data is being sent to third-party services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The TTS invocation hard-codes '--lang zh', which imposes a specific language/locale regardless of user preference. The file does not offer opt-in language selection or explain why Chinese-only output is required, which matches the language/locale policy violation criteria.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh [ -z "$DURATION" ] && DURATION=1 # Step 4: Get tenant_access_token TOKEN=$(curl -sf -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])") # Step 6: Send audio message RESULT=$(curl -sf -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This code sends local audio content to an external service endpoint, which is a genuine external data exfiltration path by design. In the context of voice-message handling, the transmitted content can include private conversations, secrets, or personal data, making the transfer security-relevant rather than a harmless network call.
- Content
sh [ ! -f "$AUDIO_FILE" ] && echo "ERROR: File not found: $AUDIO_FILE" >&2 && exit 1 RESULT=$(curl -sf "https://api.elevenlabs.io/v1/speech-to-text" \ -H "xi-api-key: $ELEVENLABS_API_KEY" \ -F "model_id=scribe_v1" \ -F "file=@$AUDIO_FILE")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script uploads the provided audio file to ElevenLabs' external speech-to-text API without any user-facing notice, consent check, or runtime warning. Because Feishu voice messages may contain sensitive or regulated content, this creates a real privacy and data-handling risk even if the transmission is functionally intended.
- Content
Static analysis
No suspicious patterns detected.