ClawHub
Back to skill

Security audit

Feishu Voice (ListenHub)

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but it should be reviewed because a helper script can run unintended local code from a crafted argument while the skill also handles real Feishu sending credentials.

Review before installing. Use dedicated, least-privilege ListenHub and Feishu credentials, avoid sensitive message text unless both services are acceptable for that data, confirm recipient IDs before sending, and do not run scripts/list-speakers.sh with untrusted language arguments until it is fixed to pass the argument as data instead of interpolating it into Python code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation clearly directs use of shell commands and implies file access, but it does not declare those capabilities as permissions. This weakens transparency and consent because users and tooling cannot accurately assess that the skill can invoke shell utilities and interact with local files as part of setup and operation.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill instructs users to read Feishu app credentials from a local OpenClaw config file, expanding scope from TTS/message sending into local secret extraction. Even if intended for convenience, this creates a path for unnecessary access to sensitive credentials stored elsewhere on the system and normalizes secret harvesting from unrelated local configuration.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation tells users how to extract sensitive Feishu credentials from a local config file but provides no warning about the sensitivity of those secrets, storage risks, shell history exposure, or downstream misuse. This increases the chance of accidental disclosure and unsafe handling of app credentials during setup.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script sends user-supplied text to ListenHub and then uploads the generated audio to Feishu, but it provides no disclosure, consent gate, or content-sensitivity warning. In a messaging skill, that means potentially private or regulated content can be transmitted to third parties without the user's informed awareness, increasing privacy and compliance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal