T09 · Insecure Skill Coding Practices
Error
- Location
voice_input_baidu_smart.py:179- Finding
Standby microphone audio is transmitted to Baidu before wake-word validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Voice Listener
Security checks for vulnerabilities and agentic risk
Overview
This voice-listener skill does what it advertises, but it under-discloses that standby microphone speech is sent to Baidu and includes unsafe guidance around credentials and elevation.
Review before installing. Use only if you accept continuous microphone monitoring and cloud processing by Baidu, including speech heard before the wake word. Avoid dictating near terminals, admin tools, or sensitive apps because recognized text may be pasted into the focused window. Do not run it as administrator unless you have a specific, understood need, and add your own .gitignore for baidu_config.json before publishing or sharing the skill directory.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
UPLOAD_GUIDE.md:5- Finding
Missing .gitignore can cause Baidu API credentials to be committed to a public repository
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
README.md:263- Finding
Documentation recommends unnecessary administrator execution for the complete listener process
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (42)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python 启动音频流... ✅ 音频系统已启动 🔐 获取百度Access Token... ✅ Token获取成功 ============================================================
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic insertion at the cursor position but does not present it as a safety warning or emphasize the risk of unintended text being injected into whatever application is focused. In continuous listening mode, misrecognition or accidental capture could cause text to be entered into chats, terminals, documents, or other sensitive contexts without adequate user awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README describes sending requests to Baidu for speech recognition but does not clearly warn users that their recorded audio is transmitted to a third-party cloud service for processing. This creates a privacy and consent issue because users may unknowingly disclose sensitive spoken content to an external provider.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly promotes continuous microphone listening and use of Baidu speech recognition, which implies audio capture and transmission to a third party, but it does not clearly warn users about privacy implications, consent requirements, retention by the provider, or risks of collecting nearby conversations. In a voice-listening skill, this omission is security-relevant because users may enable always-on capture without understanding that sensitive spoken data could be recorded or sent off-device.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes automatic text input and clipboard fallback without warning that recognized speech may be injected into whichever application has focus, or that clipboard contents may overwrite existing sensitive data. This can cause accidental command execution, disclosure, or corruption of user data if the active window is a terminal, chat app, browser, or privileged interface.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explains that after the wake word is spoken, all subsequent speech is automatically inserted at the current cursor position, but it does not clearly warn about the risk of unintended edits, command entry, or data corruption. Because input is injected wherever focus currently is, accidental speech could modify documents, chats, terminals, or admin consoles.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation states that it uses Baidu's speech recognition API but does not clearly warn users that captured audio and transcribed content are sent to a third-party service. In a continuously listening workflow, this can expose sensitive spoken information without informed consent, creating a real privacy and data-sharing risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes an activated mode where all recognized speech is automatically typed into whatever application currently has focus, but it does not prominently warn users about the scope of that behavior or the risk of unintended input after wake-up. In this context, accidental wake-ups, background speech, or misunderstood commands could inject text into chats, terminals, forms, or search bars, leading to privacy leaks or unintended actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation recommends generic wake words such as '开始' and '指令', which are common conversational terms and therefore much more likely to trigger unintentionally. In a skill that automatically types recognized speech after activation, broad wake words materially increase the chance of accidental activation followed by unintended text injection into the active application.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The guide promotes publishing and installing a continuously listening voice skill, but the security section only discusses API key handling and omits privacy disclosures about microphone capture, continuous listening behavior, and transmission of speech data to Baidu. This can mislead users into enabling a skill with significant privacy implications without informed consent, increasing the risk of unintended audio collection or third-party data exposure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill metadata and wake/stop words are defined only in Chinese, implying a fixed language interaction model without any visible user opt-in or localization fallback. This can cause users to unknowingly enable always-on voice behavior with commands they may not understand, increasing the chance of accidental activation, failed deactivation, or privacy-impacting misoperation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The stop trigger is configured as the very common word '停止', which can easily appear in normal conversation, media playback, or dictated content. In a continuously listening voice skill, this creates an easy denial-of-service condition where the assistant can be unintentionally or externally silenced, reducing availability and reliability.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest explicitly advertises continuous voice listening and wake-word activation, but it does not warn users that microphone audio may be continuously captured while enabled. In a voice-listening skill, the absence of a clear privacy notice and consent language increases the risk of unintended surveillance, sensitive data capture, and user misunderstanding about when recording occurs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest states that Baidu speech recognition is used and that API credentials are required, but it does not disclose that captured voice data may be transmitted to an external third-party service. This can expose sensitive spoken content to external processing without informed user consent, which is especially risky for a continuously listening assistant.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The visible skill name, descriptions, commands, and wake-word configuration are entirely in Chinese, with no indication that users can choose another language or locale. This may violate language-choice policy because the skill appears to impose a single language experience without explicit opt-in or documented regional limitation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest defines a very broad stop trigger word, "停止", without any scope restriction, confirmation, or context gating. In a continuously listening voice skill that supports wake-word activation and persistent voice input, a generic stop phrase can be triggered accidentally by ambient speech or injected audio, causing denial of service or unreliable control of the listener state.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s natural-language interface, instructions, and wake/stop words are entirely specified in Chinese, including mandatory voice commands like '小龙虾' and '停止'. There is no indication that users may select another language or locale, and no documented justification that this skill is intentionally limited to a Chinese-speaking region or audience.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 启动语音监听 try: subprocess.run([sys.executable, script_path], check=True) except KeyboardInterrupt: print("\n\n语音监听已停止") except Exception as e:
Static analysis
No suspicious patterns detected.