iFlytek ASR - 讯飞语音转文字

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:03 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its YouTube downloader weakens HTTPS safety and can be steered to non-YouTube hosts, so it should be reviewed before installation.

Install only if you are comfortable uploading selected audio or downloaded YouTube media to iFlytek and storing iFlytek API credentials in a local .env file. Before use, remove the downloader certificate-bypass option, tighten URL validation to canonical YouTube hosts, and prefer pinned dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_audio.py:83
• Finding: TLS Certificate Verification Disabled in YouTube Downloader<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/download_audio.py:83-94` - `scripts/download_audio_simple.py:85-97` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code `scripts/download_audio.py:83-94`: ```python cmd = [ ytdlp_cmd, '-x', # Extract audio '--audio-format', 'mp3', # Convert to MP3 '--audio-quality', '0', # Best quality '-o', output_template, '--no-check-certificates', # 跳过证书检查 '--extractor-args', 'youtube:player_client=android', # 使用 Android 客户端 '--user-agent', 'Mozilla/5.0 (Linux; Android 13) AppleWebKit/537.36', # Android UA youtube_url ] ``` `scripts/download_audio_simple.py:85-97`: ```python cmd = [ ytdlp_cmd, '-f', 'bestaudio/best', # 下载最佳音频流，或最佳视频流 '--extract-audio', # 提取音频 '-o', output_template, '--no-check-certificates', '--extractor-args', 'youtube:player_client=android,web', '--user-agent', 'Mozilla/5.0 (Linux; Android 13) AppleWebKit/537.36', '--no-warnings', youtube_url ] ``` ### Technical Analysis Both downloader implementations pass `--no-check-certificates` to `yt-dlp`. This option disables TLS server-certificate validation for network requests made by the downloader. TLS certificate validation is responsible for authenticating remote servers and preventing an intermediary from impersonating them. Encryption without certificate verification does not provide reliable endpoint authentication. A network-positioned attacker could therefore present a forged certificate and return attacker-controlled responses. The bypass is not required by the Skill's declared YouTube download and cloud-transcription functionality. It expands the network trust boundary beyond what is necessary and is particularly dangerous when combined with the insufficient URL validation documented separately. ### Attack Path 1. A user or Agent invokes either downloader with a supported-looking URL. 2. The script star ...[truncated 1339 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--no-check-certificates` from both downloader command arrays. 2. Retain the operating system and Python certificate-store defaults. 3. If certificate validation fails, fix the underlying trust-store, proxy, or CA configuration rather than bypassing authentication. 4. Reject HTTPS interception proxies unless their CA has been deliberately installed by the system administrator. 5. Add automated tests that verify neither downloader passes certificate-bypass options to `yt-dlp`. 6. Combine this correction with strict URL parsing and hostname allowlisting. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/download_audio.py:17
• Finding: Insufficient YouTube URL Validation Permits Requests to Attacker-Controlled Hosts<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/download_audio.py:17-25, 83-96` - `scripts/download_audio_simple.py:17-25, 85-99` **Vulnerability Type**: Improper input validation and network destination restriction **Risk Level**: Medium ### Vulnerable Code The same validation logic appears in both downloader scripts: ```python def extract_video_id(url): """Extract video ID from YouTube URL.""" patterns = [ r'(?:youtube\.com/watch\?v=|youtu\.be/|youtube\.com/embed/|youtube\.com/v/)([a-zA-Z0-9_-]{11})', r'^([a-zA-Z0-9_-]{11})$' ] for pattern in patterns: match = re.search(pattern, url) if match: return match.group(1) raise ValueError(f"Could not extract video ID from: {url}") ``` After extracting a video ID, `scripts/download_audio.py` passes the original, untrusted URL to `yt-dlp`: ```python cmd = [ ytdlp_cmd, '-x', '--audio-format', 'mp3', '--audio-quality', '0', '-o', output_template, '--no-check-certificates', '--extractor-args', 'youtube:player_client=android', '--user-agent', 'Mozilla/5.0 (Linux; Android 13) AppleWebKit/537.36', youtube_url ] result = subprocess.run(cmd, check=True, capture_output=True, text=True) ``` `scripts/download_audio_simple.py` follows the same pattern: ```python cmd = [ ytdlp_cmd, '-f', 'bestaudio/best', '--extract-audio', '-o', output_template, '--no-check-certificates', '--extractor-args', 'youtube:player_client=android,web', '--user-agent', 'Mozilla/5.0 (Linux; Android 13) AppleWebKit/537.36', '--no-warnings', youtube_url ] result = subprocess.run(cmd, check=True, capture_output=True, text=True) ``` ### Technical Analysis The regular expression searches for a YouTube-looking substring anywhere in the supplied input. It does not parse the URL or verify that the actual hostname belongs to YouTube. For example, an input shaped like the following can contain a valid m ...[truncated 2313 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse URLs with `urllib.parse.urlparse()` instead of searching the raw input for a matching substring. 2. Require the `https` scheme for URL inputs. 3. Compare the normalized hostname against an explicit allowlist, for example: - `youtube.com` - `www.youtube.com` - `m.youtube.com` - `youtu.be` 4. Reject hostnames that only end in or contain trusted text, such as `youtube.com.attacker.example`. 5. Validate the video ID using a full match against `[A-Za-z0-9_-]{11}`. 6. After validation, reconstruct a canonical URL from the extracted ID: ```python canonical_url = f"https://www.youtube.com/watch?v={video_id}" ``` 7. Pass only `canonical_url`, rather than the original user input, to `yt-dlp`. 8. Remove `--no-check-certificates`. 9. Add negative tests for URLs containing YouTube strings in attacker-controlled paths, queries, user-information sections, and subdomains. ]]>

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Open-Ended Third-Party Dependencies Are Installed Without Integrity Pinning<![CDATA[ ## Vulnerability Details **File Locations**: - `requirements.txt:1-3` - `install.sh:15-23` - `SKILL.md:43-47` - `README.md:15-19` - `QUICKSTART.md:5-9` **Vulnerability Type**: Unpinned dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text yt-dlp>=2024.1.0 requests>=2.31.0 python-dotenv>=1.0.0 ``` `install.sh:15-23`: ```bash # 安装依赖 echo "" echo "📦 安装 Python 依赖..." pip3 install -r requirements.txt if [ $? -ne 0 ]; then echo "❌ 依赖安装失败" exit 1 fi ``` The documentation also directs users to install open-ended packages directly: ```bash pip3 install yt-dlp requests python-dotenv ``` ### Technical Analysis The requirement entries specify minimum versions but no upper bounds, exact versions, or artifact hashes. A future installation may therefore resolve to any newer package release available from the configured Python package index. Package installation can execute package build or installation logic. After installation, the scripts import `requests` and `python-dotenv`, and locate and execute the `yt-dlp` program. Consequently, a compromised future release, compromised package-maintainer account, malicious package-index response, or unsafe alternate index could introduce code that executes with the installing user's privileges. No evidence was found that the currently named packages are typosquatted or malicious. The vulnerability is the absence of reproducible version and integrity controls, not a confirmed malicious dependency. The installer also invokes ambient `pip3` rather than creating an isolated virtual environment, increasing the chance of modifying a global or user-wide Python environment. ### Attack Path 1. An attacker compromises a dependency maintainer, release account, package-index path, or configured alternate package repository. 2. A malicious version newer than the stated minimum is published or served. 3. A user runs `install.sh` or follows the documented `p ...[truncated 1117 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to an exact reviewed version rather than using open-ended minimum constraints. 2. Generate and maintain a lock file containing cryptographic hashes for every permitted distribution. 3. Install with hash enforcement, such as: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Create and activate a dedicated virtual environment before installation: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 5. Use `python3 -m pip` instead of ambient `pip3` to ensure installation targets the intended interpreter. 6. Do not recommend global or privileged installation. 7. Review dependency release notes and security advisories before updating pinned versions. 8. Use an approved package index and explicitly control any mirror or alternate-index configuration. 9. Add dependency scanning and reproducible-installation checks to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (62)

Tainted flow: 'params' from os.getenv (line 137, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

with open(file_path, "rb") as f:
        file_data = f.read()

    resp = requests.post(URL_UPLOAD, params=params, headers=headers, data=file_data)
    result = resp.json()
    print(f"[调试] 上传响应: {result}")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'params' from os.getenv (line 185, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"signature": signature,
        }

        resp = requests.post(URL_GET_RESULT, params=params, headers=headers)
        result = resp.json()

        if result.get("code") != "000000":

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cd ~/.openclaw/workspace
zip -r iflytek-asr-skill.zip iflytek-asr-skill-template/ \
  -x "*.pyc" "**/__pycache__/*" ".env" "*.mp3" "*.wav" "*.txt"
```

生成的 `iflytek-asr-skill.zip` 就可以分享给别人了！

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 复制模板文件
cp .env.example .env

# 编辑 .env 文件，粘贴你的凭证
nano .env  # 或用任何文本编辑器

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# 复制模板文件
cp .env.example .env

# 编辑 .env 文件，粘贴你的凭证
nano .env  # 或用任何文本编辑器

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: Claiming support for YouTube-to-text while only accepting local file paths is misleading and can cause unsafe assumptions about what the skill will fetch or process. Even when not overtly malicious, inaccurate capability claims undermine informed consent and make security review less reliable.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 设置输出文件名
OUTPUT_NAME="iflytek-asr-skill-$(date +%Y%m%d).zip"

# 检查是否有 .env 文件（警告用户）
if [ -f .env ]; then
    echo "⚠️  警告：检测到 .env 文件！"
    echo "   .env 包含你的 API 凭证，不应该被分发。"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.