english-game

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This is a coherent Feishu/Lark English-game skill, with the main user consideration being its disclosed use of an external speech-to-text service for voice messages.

Before installing, confirm you are comfortable with speaking mode sending selected voice-message audio to SenseASR using SENSEAUDIO_API_KEY. Keep SENSEAUDIO_BASE_URL set only to a trusted HTTPS endpoint, and consider adding an explicit notice to group members before voice transcription is used.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tainted flow: 'base_url' from os.environ.get (line 51, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

with open(args.file, "rb") as fh:
        files = {"file": (os.path.basename(args.file), fh)}
        resp = requests.post(
            f"{base_url}{TRANSCRIBE_PATH}",
            headers=headers,
            data=data,

• Confidence: 91% confidence
• Finding: The request destination is derived from the SENSEAUDIO_BASE_URL environment variable and is used directly in requests.post while also attaching the Bearer API key and uploading the audio file. If an attacker can influence the environment, they can redirect the request to an attacker-controlled host, causing credential exfiltration and leakage of potentially sensitive voice data; in this skill context, that also exposes user speech content handled by the transcription feature.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description substantially overstates the implemented behavior. The supplied code only provides deterministic Wordle-like scoring for one guess via a CLI command, which aligns with a narrow subset of the described 'vocab' functionality. It does not implement the broader skill purpose: no Feishu/Lark interaction, no lightweight group-chat mechanics, no multiple modes ('guess' and 'speaking' are absent), no session management, and no voice transcription. This is a material description-behavior mismatch because the primary purpose described is a conversational multi-mode game skill, while the code is just a local scoring helper.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs use of an environment variable and an external ASR API, which implies access to env and network, but it does not declare any corresponding tool scope or permissions. This creates an under-specified trust boundary: a reviewer or runtime may not realize the skill can access secrets and transmit user data externally, increasing the risk of unintended secret exposure or unauthorized data egress.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The speaking mode says voice files will be downloaded and transcribed by an external ASR service but does not require a user-facing disclosure or consent warning. Because voice messages can contain sensitive personal data and biometric characteristics, silently sending them to a third party creates privacy, compliance, and data-handling risks.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger guidance allows activation from a broad natural-language phrase, which can cause the skill to engage unexpectedly in unrelated conversations. Over-broad invocation increases the chance of accidental collection of chat content, unintended state changes, or inadvertent use of external services without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file directs the assistant to always reply in a specific chat language and all provided examples are in Chinese, while the skill itself is an English-learning game. This imposes a locale/language behavior without an explicit user opt-in or a documented policy reason that the skill must respond only in Chinese.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- who solved it
- whether a round is active

Do not ask users to repeat information that already exists in recent chat context.

## Environment variables

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The display name "Feishu English Game" and description of vocabulary and speaking games indicate the skill is explicitly scoped to English. There is no accompanying language-choice or opt-in language in this file, which can violate the policy against forcing a specific language without user consent or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file states `language: en` as the default for speaking mode and reinforces this with a rationale focused on English accuracy. This is a natural-language locale policy concern because it imposes a language setting without mentioning any user opt-in, selection mechanism, or region-specific justification.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The speaking-mode instructions explicitly direct the agent to download user voice messages and transcribe them, but provide no user-facing notice, consent flow, retention guidance, or minimization requirements for audio handling. Because voice data is sensitive personal data and may contain biometric or incidental third-party information, this omission can cause privacy violations, policy noncompliance, and accidental over-collection in a group-chat setting.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The document repeatedly specifies that the skill operates on English words only, including requirements like '单词必须是规范英文词' and English proficiency bands such as CET/IELTS/TOEFL. This is a natural-language locale/language constraint, but the file does not indicate user choice, opt-in, or justification for restricting interaction to English.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The function rejects any characters outside ASCII a-z and the error message explicitly states that words must contain only English letters. This is a natural-language locale policy constraint embedded in code, and the file does not indicate user opt-in or a documented justification for enforcing English-only input.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This code contains natural-language messages such as "缺少配置" and other runtime errors in Chinese, but does not document or offer a user choice for the interface language. The policy requires avoiding forced language/locale behavior unless the user is given an opt-in choice or the constraint is clearly justified.

Static analysis

No suspicious patterns detected.