T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chattts-server.sh:47- Finding
Unauthenticated ChatTTS Service Exposed on All Network Interfaces
- Content
View full analysis
- Remediation
View remediation
Security audit
voice2feishu
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but the local TTS server is exposed more broadly than documented and uses unsafe temporary/PID files, so it should be reviewed before installation.
Review before installing. Use API mode only for text you are comfortable sending to the configured TTS provider and Feishu, restrict TTS_API_URL to a trusted HTTPS endpoint, and protect Feishu/TTS keys. If using local ChatTTS, run it only on a trusted machine/network, firewall or change it to bind to 127.0.0.1, and avoid running it as a privileged account until the temporary-file and PID-file handling are fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/chattts-server.sh:8- Finding
Predictable Shared Temporary Files and Untrusted PID File
- Content
View full analysis
/tmp/chattts_server.py << 'PYEOF' ``` ```bash nohup python3 /tmp/chattts_server.py > "$LOG_FILE" 2>&1 & echo $! > "$PID_FILE" ``` ```bash PID=$(cat "$PID_FILE") if ps -p "$PID" > /dev/null 2>&1; then kill "$PID" rm -f "$PID_FILE" fi ``` ### Technical Analysis Several runtime files are placed directly in the shared `/tmp` directory. Audio filenames use second-resolution timestamps and are consequently predictable. Other paths, including the generated Python server, log, and PID file, are fixed. The scripts do not use `mktemp`, a private runtime directory, exclusive file creation, ownership validation, symlink checks, or restrictive permissions. Shell redirection and tools such as `curl` and FFmpeg may follow a pre-created symbolic link. If the Skill runs under an account that can write the symlink target, this can overwrite an unintended file. The server stop routine also trusts the numeric contents of `/tmp/chattts-server.pid`. It checks only whether that PID exists and does not verify the PID file owner, process owner, executable path, start time, or command line before sending a signal. ### Attack Path #### Predictable-file attack 1. An attacker predicts the next timestamp-based output filename or targets one of the fixed paths. 2. The attacker creates a symbolic link at that path pointing to another file writable ...[truncated 1239 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/api-tts.sh:10- Finding
TTS Bearer Credential Can Be Sent to an Unrestricted Configurable Endpoint
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:134- Finding
Unpinned Third-Party Packages, Repository Code, and Model Artifacts
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/chattts-server.sh:83- Finding
Generated ChatTTS Audio Files Are Never Deleted
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior does not cleanly match the detected capabilities: the skill advertises text-to-speech delivery to Feishu, but also includes local HTTP service lifecycle management and does not clearly evidence all claimed behaviors. Security review depends on accurate behavior descriptions; when a skill can start/stop local services beyond its stated purpose, reviewers may underestimate attack surface and side effects. This is especially risky because service management can persist processes, open ports, and alter host state.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README instructs users to send text to external TTS providers and then transmit generated audio into Feishu, but it does not clearly warn that message contents may leave the local environment and be processed by third-party services. In a messaging skill, this can cause accidental disclosure of sensitive content or unintended outbound communications because users may assume the tool is purely local or low-risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
OpenAI TTS
bash export TTS_API_URL="https://api.openai.com/v1/audio/speech" export TTS_API_KEY="your_openai_key"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill declares required environment variables and shell/binary dependencies but does not define an explicit tool/permission scope. That makes the operational boundary unclear to users and auditors, increasing the chance that a host agent grants broader shell or environment access than intended. In a skill that handles secrets and networked messaging, implicit capabilities are a real security concern.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 82% confidence
- Finding
The skill is configured to transmit user-provided text and API credentials to external TTS endpoints. While external transmission is core to API mode, it becomes a security issue when sensitive message content may be sent off-platform without strong disclosure, domain restrictions, or secret-handling guarantees. The presence of Feishu credentials and outbound network use increases the sensitivity of the environment.
- Content
export TTS_API_KEY="your_api_key" export TTS_API_URL="https://open.bigmodel.cn/api/paas/v4/audio/speech" # 智谱
或
export TTS_API_URL="https://api.openai.com/v1/audio/speech" # OpenAI
text ### 2. 发送语音
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation instructs users to send arbitrary text to third-party TTS APIs but does not present a clear warning that message contents leave the local environment and may be processed by external providers. Users may unknowingly transmit sensitive business, personal, or regulated data to external services. In a messaging skill, this context raises the likelihood that confidential content is involved.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
This section again documents use of an external OpenAI TTS endpoint, reinforcing that message text will be transmitted to a third party. Repetition alone is not malicious, but without privacy, retention, and data-sensitivity warnings it can lead to unintentional disclosure of confidential content. In this skill's context, outbound audio-generation requests are expected but still materially expand data-exposure risk.
- Content
OpenAI TTS
bash export TTS_API_URL="https://api.openai.com/v1/audio/speech" export TTS_API_KEY="your_openai_api_key"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This curl call performs an external network transmission of user-supplied text and an API credential to a configurable remote endpoint. In the context of a skill that may be used on arbitrary content, the danger is not the network access itself but the lack of restrictions, trust validation, or warning around where data is sent, especially since TTS_API_URL can be overridden to an unintended destination.
- Content
sh echo "🔊 生成语音..." OUTPUT_FILE="/tmp/voice2feishu-api-$(date +%s).mp3" HTTP_CODE=$(curl -s -w "%{http_code}" -o "$OUTPUT_FILE" \ -X POST "$TTS_API_URL" \ -H "Authorization: Bearer $TTS_API_KEY" \ -H "Content-Type: application/json" \
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends arbitrary user-provided text to a third-party TTS service without any explicit consent prompt, warning, or data-classification guardrail. This creates a real privacy and data-handling risk because users may unknowingly submit sensitive content, which is then disclosed to an external provider and potentially logged or retained outside the local environment.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 65% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh PYEOF # 后台启动 nohup python3 /tmp/chattts_server.py > "$LOG_FILE" 2>&1 & echo $! > "$PID_FILE" echo "⏳ 等待服务启动..."
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # 1. 检查 ChatTTS 服务 echo "🔍 检查 ChatTTS 服务..." if ! curl -s --connect-timeout 3 "$CHATTTS_URL/health" > /dev/null 2>&1; then echo "❌ ChatTTS 服务未启动" echo "" echo "请先启动服务:"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "📤 上传到飞书" # 1. 获取飞书 token TOKEN_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\": \"$APP_ID\", \"app_secret\": \"$APP_SECRET\"}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh FILE_KEY=$(echo "$UPLOAD_RESPONSE" | jq -r '.data.file_key') # 5. 发送音频消息 SEND_RESPONSE=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d "{
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All user-facing instructions and examples are presented only in Chinese, and the skill description does not indicate that this is a China-specific or Chinese-only tool, nor does it offer language choice. Under the stated policy, forcing a specific language without user opt-in can be a locale policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script's comments, usage text, and runtime status/error messages are written in Chinese throughout, including the primary user-facing interface. This imposes a specific language/locale without any opt-in or indication that the skill is intentionally region-specific.
- Content