ClawHub
Back to skill

Security audit

voice2feishu

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but its local ChatTTS mode starts an unauthenticated server exposed on all network interfaces despite being described as localhost/local.

Review before installing. Use it only if you are comfortable giving it Feishu message-sending credentials and, in API mode, sending message text to the configured TTS provider. For local ChatTTS, bind the service to 127.0.0.1 or firewall it, avoid exposing port 8080 to other machines, and stop the service when finished.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README explicitly instructs users to send message content to third-party TTS providers such as 智谱/OpenAI and to configure service credentials, but it does not warn users that message text may leave the local environment and be processed by external services. In a skill that handles potentially sensitive chat content and enterprise messaging credentials, this omission can lead to unintentional data disclosure and poor operator understanding of privacy risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script transmits arbitrary user-provided text to a third-party TTS service, but it does not provide an explicit privacy warning, consent prompt, or data-handling notice before doing so. This is dangerous because users may unknowingly send sensitive or regulated information to an external provider, creating confidentiality, compliance, and data-governance risks.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The generated Flask service binds to 0.0.0.0, exposing the TTS endpoint on all network interfaces without authentication or access controls. In this skill context, that makes a model-backed synthesis service remotely reachable by other hosts, enabling unauthorized use, denial of service through expensive requests, and unintended exposure of local resources or generated content.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script transmits user-supplied text to a TTS service over plain HTTP and does so silently, without an explicit warning or consent prompt. Even if the default target is localhost, the URL is configurable via CHATTTS_URL, so sensitive text may be sent to a remote or intercepted endpoint, creating confidentiality risk.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "🔊 生成语音..."
OUTPUT_FILE="/tmp/voice2feishu-api-$(date +%s).mp3"

HTTP_CODE=$(curl -s -w "%{http_code}" -o "$OUTPUT_FILE" \
  -X POST "$TTS_API_URL" \
  -H "Authorization: Bearer $TTS_API_KEY" \
  -H "Content-Type: application/json" \
Confidence
91% confidence
Finding
The curl call sends user-supplied text and an API credential to an external endpoint specified by TTS_API_URL, which constitutes outbound data transmission to a third party. In this skill's context, external transmission is expected functionality, but it still becomes a real security/privacy issue because the script does not constrain the destination, validate the endpoint, or warn users that potentially sensitive text leaves the local environment.

Static analysis

No suspicious patterns detected.