ClawHub
Back to skill

Security audit

Feishu Voice Sender

Security checks for vulnerabilities and agentic risk

Overview

The skill’s voice-message purpose is coherent, but it delegates execution to an unpinned external script with the full environment and falsely reports Feishu delivery as successful.

Review before installing. Use only in an environment where the xiaomi-mimo-tts dependency is trusted and protected from tampering, restrict the subprocess environment to required variables, and do not rely on this version for actual Feishu delivery until the send function is implemented and verified. Avoid sending sensitive text unless the external TTS and messaging data flows are acceptable for your use case.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
feishu_voice_sender.py:24
Finding

Unpinned External Skill Executes with Access to the Full Parent Environment

Content
View full analysis

Vulnerability Details

File Location: feishu_voice_sender.py:24-41; installation guidance in SKILL.md:42-45 and dependency declaration in SKILL.md:186-191
Vulnerability Type: Unsafe third-party dependency execution and excessive environment-variable exposure
Risk Level: High

Vulnerable Code

python
# 检查脚本路径
script_path = os.path.expanduser("~/.openclaw/skills/xiaomi-mimo-tts/scripts/smart/mimo_tts_smart.js")
if not os.path.exists(script_path):
    print(f"❌ 错误: 找不到脚本 {script_path}")
    return False

try:
    # 运行小米 MiMo TTS 脚本
    env = os.environ.copy()
    env['MIMO_API_KEY'] = api_key

    result = subprocess.run(
        ['node', script_path, text, output_file],
        env=env,
        capture_output=True,
        text=True
    )

The corresponding installation instruction is:

bash
# 安装小米 MiMo TTS 技能
clawhub install xiaomi-mimo-tts

Technical Analysis

The skill executes a Node.js file supplied by the separately installed xiaomi-mimo-tts skill. No dependency version, package digest, script checksum, trusted publisher identity, ownership, or filesystem permissions are verified before execution. The existence check confirms only that a file is present at the expected path; it does not establish that the file is authentic or safe.

The subprocess is also given os.environ.copy(), which exposes every environment variable available to the Python process. Although only MIMO_API_KEY is required for the documented operation, the external script can access unrelated API keys, cloud credentials, messaging tokens, database passwords, and other secrets present in the environment.

Passing arguments as a list without shell=True prevents direct shell injection through text or output_file in this code. The principal risk is instead the trust placed in an unverified external executable and the unnecessarily broad secret exposure.

Attack Path

  1. An a ...[truncated 1617 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the external skill to an explicitly reviewed version rather than installing an unconstrained latest release.

  2. Verify the package publisher and cryptographic digest during installation.

  3. Verify the script's checksum, ownership, and permissions before every execution, or bundle a reviewed implementation directly with this skill.

  4. Replace os.environ.copy() with a minimal environment containing only required variables. For example:

    python
    env = {
    "PATH": os.environ.get("PATH", ""),
    "MIMO_API_KEY": api_key,
}

    If Node requires additional variables, add only those that have been individually reviewed.

  5. Run the TTS process under a restricted account or sandbox with narrowly scoped filesystem and network access.

  6. Use a dedicated, least-privileged TTS API credential that cannot access unrelated services.

  7. Prevent unauthorized modification of the installed script through restrictive ownership and filesystem permissions.

  8. Document the exact trusted dependency version and integrity value in the project metadata.

T09 · Insecure Skill Coding Practices

Warning
Location
feishu_voice_sender.py:54
Finding

Feishu Sending Stub Reports Success Without Delivering a Message

Content
View full analysis

Vulnerability Details

File Location: feishu_voice_sender.py:54-65
Vulnerability Type: Fail-open success reporting and missing delivery implementation
Risk Level: Medium

Vulnerable Code

python
def send_feishu_voice(file_path):
    """发送飞书语音消息"""
    try:
        # 使用 OpenClaw message 工具发送语音
        # 这里需要调用 OpenClaw 的 message 工具
        # 实际实现需要根据 OpenClaw 的 API 调用方式

        print(f"✅ 飞书语音消息发送成功: {file_path}")
        return True

    except Exception as e:
        print(f"❌ 飞书语音消息发送失败: {e}")
        return False

Technical Analysis

send_feishu_voice() does not invoke a Feishu API, an OpenClaw message tool, or any other delivery mechanism. Nevertheless, it prints a success message and returns True. The comments explicitly state that the actual API integration still needs to be implemented.

In send_voice(), this return value becomes the overall operation result. In main(), a true result produces exit status zero. Consequently, both users and automated callers receive a false confirmation that the voice message was delivered.

This is an integrity and reliability issue with potential security consequences when the skill is used for alerts, approvals, incident notifications, or other workflows in which confirmed delivery is significant.

Attack Path

  1. A user or automated workflow invokes the script to send a Feishu voice notification.
  2. The external TTS process successfully generates voice_mimo.ogg.
  3. send_voice() calls send_feishu_voice().
  4. The function performs no message transmission.
  5. It prints a successful-delivery statement and returns True.
  6. main() exits with status zero.
  7. The caller records the notification as successfully delivered even though no recipient received it.

No attacker interaction is necessary to trigger the defect. An attacker who can influence operational reliance on this skill could exploit the misleading result ...[truncated 734 chars]

Remediation
View remediation

Remediation Suggestions

  1. Implement the authenticated Feishu or OpenClaw message API call before claiming that sending is supported.
  2. Return success only after receiving and validating a successful response from the delivery service.
  3. Validate that the response includes an expected message identifier and accepted delivery state.
  4. Treat network errors, authentication failures, malformed responses, timeouts, and rejected uploads as failures.
  5. Until delivery is implemented, replace the current behavior with an explicit unsupported-operation error and a nonzero exit status.
  6. Add integration tests that verify a message API call occurs and that failed API responses propagate to the process exit status.
  7. Avoid wording that implies recipient delivery when the upstream API confirms only upload or queue acceptance; report the precise state.
  8. Update README.md and SKILL.md so their feature claims match the implemented behavior.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
97% confidence
Finding

Copying the entire process environment and passing it to an external script can expose unrelated secrets, tokens, proxy settings, and internal configuration to code outside the Python skill's direct control. This is especially dangerous here because the external script resides in a user-home skill path, so compromise or tampering of that script would allow broad credential harvesting.

Content

Scanner excerpt · feishu_voice_sender.py (reported line 33)May include surrounding context.

python
try:
        # 运行小米 MiMo TTS 脚本
        env = os.environ.copy()
        env['MIMO_API_KEY'] = api_key
        
        result = subprocess.run(

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring 发送飞书语音消息 and surrounding comments indicate this function sends a Feishu voice message. However, the body contains no API call, tool invocation, or outbound operation—only placeholder comments and a success print—so the documented intent directly contradicts actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states that the skill generates voice via MiMo TTS and sends messages into Feishu channels, but it does not clearly disclose that user-provided text may be transmitted to external services and reposted to third-party destinations. This creates a privacy and data-handling risk because operators may unknowingly send sensitive content to an external TTS provider and into chat systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises behavior that relies on environment variables and shell-level operations (for installation, ffmpeg, service checks, and log inspection) but does not declare any tool scope such as permissions or allowed-tools. This increases the risk that an agent may invoke broader capabilities than users expect, reducing containment and making accidental command execution or secret access more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description explains that content may be converted with Xiaomi MiMo TTS and sent through Feishu or other platforms, but it does not clearly warn users that their text will leave the local environment and be transmitted to third-party services. This creates a privacy and data-handling risk, especially if users provide sensitive content expecting only a local transformation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
# 安装 ffmpeg (用于音频格式转换)
# Windows: winget install ffmpeg
# macOS: brew install ffmpeg
# Linux: sudo apt install ffmpeg

# 配置 API Key
export MIMO_API_KEY=your-api-key

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The auto-trigger is defined by broad natural-language phrases like '发语音给我' and '语音回复', which can overlap with normal conversational requests. In an agent setting, this can cause the skill to activate unexpectedly and send user content to external TTS or messaging channels without sufficiently explicit intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill extends its effective trust boundary by executing an external Node.js script from a user-writable home-directory path and supplying it with an API credential. That is risky because the Python skill's stated purpose is narrow, but the implementation delegates sensitive behavior to separate code that could be modified, replaced, or behave unexpectedly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · feishu_voice_sender.py (reported line 36)May include surrounding context.

python
env = os.environ.copy()
        env['MIMO_API_KEY'] = api_key
        
        result = subprocess.run(
            ['node', script_path, text, output_file],
            env=env,
            capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Launching a subprocess is a safety-relevant operation for code files under this rule. While the code comments describe that a MiMo TTS script is run, there is no clear user-facing disclosure in the interface or top-level documentation that executing this skill will call an external Node.js script and pass the user's text to it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Natural-language policy violations apply to all file types, including markdown. The README forces a specific language presentation for all users and does not indicate that Chinese is optional, selectable, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This Python code generates and saves speech output to a local file (voice_mimo.ogg by default), which is a file-write operation covered by the missing-warning rule for code files. Although success is logged after generation, there is no prior user-facing disclosure in comments, docstrings, or prompts that running the skill will create a local audio file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Access to sensitive environment variables is in scope for missing-warning findings on code files. The code checks for MIMO_API_KEY and reports when it is absent, but it does not clearly disclose up front that the skill depends on and will use an external-service API credential.

Content

No source excerpt is available for this finding.