Security audit

Wecom Voice

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent WeCom voice-message purpose, but its script handles user input unsafely and can send content to an under-disclosed default recipient.

Review this carefully before installing. It sends generated audio externally through WeCom, defaults to a named recipient if none is provided, and currently has command-injection flaws in both message text and recipient handling. It should require an explicit recipient, use argument-safe process APIs, remove or secure temporary files, and clearly confirm the destination before sending.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send-voice.cjs:27
Finding: Arbitrary PowerShell Code Execution Through Unsanitized Speech Text
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/send-voice.cjs:68
Finding: Shell Command Injection Through the Target User Argument
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/send-voice.cjs:9
Finding: Undisclosed Hard-Coded Default Recipient Causes Unintended Data Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send-voice.cjs:12
Finding: Predictable Shared Temporary Script and Persistent Voice Artifacts
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes user-supplied message text into a temporary PowerShell script on disk, which creates an unnecessary local plaintext artifact of potentially sensitive content. Although it attempts cleanup, the file may remain if the process crashes or is interrupted, allowing other local users or software to recover message contents.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes a text-to-speech and send workflow, but the implementation achieves it by spawning external executables: PowerShell with ExecutionPolicy Bypass for TTS generation and ffmpeg.exe for transcoding. Launching arbitrary system subprocesses is a broader and more sensitive capability than the stated business purpose and is not explicitly disclosed in the manifest description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script invokes openclaw message send to transmit the generated AMR file to a WeCom recipient. While the step is labeled 'Send', there is no explicit disclosure that the synthesized audio will be delivered to another user/channel, which is a network or external transmission operation that should be clearly warned about.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "voice message" is generic and likely to appear in normal user conversation, which can cause unintended activation of the skill. Because this skill sends generated content into WeCom, accidental triggering could lead to unreviewed message generation and delivery to contacts or channels.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description explains the workflow but does not clearly warn users that text is converted to speech, written to a local media directory, and then sent onward. This lack of disclosure increases the risk of users unintentionally causing sensitive content to be persisted locally and transmitted through WeCom.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: Forcing a specific voice/language (Microsoft Huihui Desktop, Chinese) without user opt-in can cause content to be spoken in an unexpected language or accent, creating privacy, usability, and misdelivery risks in enterprise messaging contexts. While not inherently code-execution dangerous, it can cause the wrong message to be conveyed or expose that automation is being used without the sender's informed choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The PowerShell TTS configuration hard-codes Microsoft Huihui Desktop, which implies a fixed locale/voice choice without offering the user an alternative. This is a natural-language policy concern because it enforces a language or locale preference rather than allowing user selection.
Content: No source excerpt is available for this finding.