Feishu Voice (ListenHub)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:24 AM UTC
• Version: 1.0.1

Overview

The skill mostly does what it says, but a helper script has a confirmed code-injection flaw and the skill handles Feishu and ListenHub credentials.

Review before installing. Use only with a least-privileged Feishu app and a dedicated ListenHub key, avoid sending sensitive text to TTS, and do not pass untrusted language values to list-speakers.sh unless the injection bug is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/list-speakers.sh:17

Finding

Arbitrary Python Code Injection Through the Language Argument

Content

View full analysis

Remediation

View remediation

&2 exit 2 ;; esac printf '%s' "$RESP" | python3 -c ' import json import sys data = json.load(sys.stdin) lang_filter = sys.argv[1] for item in data["data"]["items"]: if lang_filter and item["language"] != lang_filter: continue print( f"{item['"'"'speakerId'"'"']:40s} " f"{item['"'"'name'"'"']:10s} " f"{item['"'"'gender'"'"']:6s} " f"{item['"'"'language'"'"']}" ) ' "$LANGUAGE" ``` Additional hardening measures: 1. Treat every command-line argument as untrusted, including values selected or generated by an Agent. 2. Prefer a standalone Python file over dynamically constructed source code for nontrivial parsing. 3. Use an explicit allowlist for accepted language identifiers. 4. Run the Skill under a dedicated least-privileged account with access only to required credentials and files. 5. Avoid inheriting unrelated secrets in the Skill process environment. 6. Add regression tests containing quotes, semicolons, newlines, backslashes, and Python expressions to verify that arguments remain data rather than executable code. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a user-facing skill for generating and sending Feishu voice messages via ListenHub TTS. The supplied code only calls a speaker-list endpoint (/speakers/list) using an API key and prints available speakers, optionally filtered by language. This is related to ListenHub voice selection, but it is only a support utility and lacks the core advertised behavior: no text-to-speech generation, no voice message creation, and no Feishu integration. Therefore the actual behavior is materially narrower and different from the declared primary purpose.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 41)May include surrounding context.

sh

" "$TMPDIR/req.json" "$TEXT" "$SPEAKER_ID"

# Step 2: Create TTS task
TTS_RESP=$(curl -sS -X POST "$API_BASE/podcast/episodes" \
  -H "Authorization: Bearer $LISTENHUB_API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TMPDIR/req.json")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 52)May include surrounding context.

sh

AUDIO_URL=""
for i in $(seq 1 12); do
  sleep 5
  STATUS_RESP=$(curl -sS "$API_BASE/podcast/episodes/$EPISODE_ID" \
    -H "Authorization: Bearer $LISTENHUB_API_KEY")

  STATUS=$(echo "$STATUS_RESP" | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['processStatus'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 82)May include surrounding context.

sh

[ -z "$DURATION" ] && DURATION=1

# Step 7: Get Feishu tenant_access_token
TOKEN=$(curl -sS -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 88)May include surrounding context.

sh

| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

# Step 8: Upload opus
FILE_KEY=$(curl -sS -X POST 'https://open.feishu.cn/open-apis/im/v1/files' \
  -H "Authorization: Bearer $TOKEN" \
  -F 'file_type=opus' \
  -F 'file_name=voice.opus' \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 97)May include surrounding context.

sh

| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])")

# Step 9: Send audio message
RESULT=$(curl -sS -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/list-speakers.sh (reported line 16)May include surrounding context.

sh

API_BASE="https://api.marswave.ai/openapi/v1"

RESP=$(curl -sS "$API_BASE/speakers/list" \
  -H "Authorization: Bearer $LISTENHUB_API_KEY")

echo "$RESP" | python3 -c "

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of shell scripts and local file access but declares no tool restrictions or permission scope. In an agent environment, this can cause the skill to run with broader-than-necessary capabilities, increasing the chance of unintended file access or command execution beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The activation condition is broader than the skill’s core purpose, allowing invocation when merely comparing Chinese TTS providers. Overbroad triggers can cause the agent to activate a skill that uses shell commands and credentials in situations where the user did not intend to send messages, increasing the chance of unnecessary secret handling or side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation tells users to extract Feishu app credentials from a separate local OpenClaw configuration file and export them into the shell environment. This encourages cross-context secret access and increases exposure of sensitive credentials to shell history, subprocesses, logs, and any other tool the agent may invoke afterward.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions provide a concrete recipe for retrieving and exporting Feishu credentials without any caution around secret exposure. In practice, this normalizes unsafe secret handling and can leak credentials through terminal history, process environments, debugging output, or downstream commands executed by the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

The hardcoded API base shows reliance on an external third-party service for processing user content. In this skill context, that makes the integration more dangerous than a local TTS flow because all message text is necessarily disclosed off-platform, creating confidentiality and compliance risk if users assume Feishu-only handling.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 24)May include surrounding context.

sh

: "${FEISHU_APP_ID:?Set FEISHU_APP_ID}"
: "${FEISHU_APP_SECRET:?Set FEISHU_APP_SECRET}"

API_BASE="https://api.marswave.ai/openapi/v1"
TMPDIR=$(mktemp -d)
trap 'rm -rf "$TMPDIR"' EXIT

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The request payload hard-codes the TTS language to 'zh', which imposes a specific language/locale choice regardless of user preference. This matches the policy-violation category because the script does not offer opt-in, selection, or documentation justifying a China-specific scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The script sends user-provided text to a third-party TTS provider, which is an intentional external transmission of potentially sensitive content. In a messaging skill, this materially increases privacy risk because message content leaves the local/Feishu environment and is exposed to ListenHub/Marswave processing, retention, and logging policies.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 41)May include surrounding context.

sh

" "$TMPDIR/req.json" "$TEXT" "$SPEAKER_ID"

# Step 2: Create TTS task
TTS_RESP=$(curl -sS -X POST "$API_BASE/podcast/episodes" \
  -H "Authorization: Bearer $LISTENHUB_API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TMPDIR/req.json")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 82)May include surrounding context.

sh

[ -z "$DURATION" ] && DURATION=1

# Step 7: Get Feishu tenant_access_token
TOKEN=$(curl -sS -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-voice-send.sh (reported line 97)May include surrounding context.

sh

| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])")

# Step 9: Send audio message
RESULT=$(curl -sS -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/list-speakers.sh (reported line 14)May include surrounding context.

sh

: "${LISTENHUB_API_KEY:?Set LISTENHUB_API_KEY}"

API_BASE="https://api.marswave.ai/openapi/v1"

RESP=$(curl -sS "$API_BASE/speakers/list" \
  -H "Authorization: Bearer $LISTENHUB_API_KEY")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code performs a network call to an external API and transmits the LISTENHUB_API_KEY in the Authorization header. While the header comments document the required environment variable, there is no runtime disclosure, confirmation, or user-facing notice that the script will contact a remote service using that credential.

Content

No source excerpt is available for this finding.