Security audit

language-helper

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real language-learning TTS helper, but it can automatically upload and send generated audio to Feishu chats without a per-use confirmation step.

Install only if you want Feishu/Lark voice-message delivery, and configure it with a narrowly scoped bot and a deliberate chat ID. Avoid using the Feishu option for private phrases unless you are comfortable sending them to that chat. Prefer environment variables or a locked-down .env file, do not commit .env or debug logs, and avoid --debug-log for sensitive text.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/helper.py:430
Finding: Debug Logs Persist Complete User Text and API Responses
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/helper.py:16
Finding: Credential-Bearing Environment File Is Created Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: scripts/feishu_api.py:134
Finding: Optional Feishu Chat Enumeration Exceeds Core TTS Functionality
Content: View full analysis
list: """List all chats the bot has joined. Returns list of {chat_id, name, chat_mode}.""" token = get_tenant_access_token() headers = {"Authorization": f"Bearer {token}"} chats = [] page_token = "" while True: url = "https://open.feishu.cn/open-apis/im/v1/chats?page_size=50" if page_token: url += f"&page_token={page_token}" payload = _get_json(url, headers=headers) if payload.get("code") != 0: code = payload.get("code", "?") msg = payload.get("msg", "") or payload.get("message", "") raise RuntimeError( f"Failed to list chats (code={code}): {msg}\n" f"Hint: make sure the Feishu app has 'im:chat:readonly' permission.\n" f"Go to https://open.feishu.cn/app → your app → Permissions → add 'im:chat:readonly'" ) for item in (payload.get("data") or {}).get("items", []): chats.append({ "chat_id": item.get("chat_id", ""), "name": item.get("name", "(unnamed)"), "chat_mode": item.get("chat_mode", ""), "description": item.get("description", ""), }) if not (payload.get("data") or {}).get("has_more"): break page_token = (payload.get("data") or {}).get("page_token", "") return chats ``` ### Technical Analysis The Skill's core purpose is translation and speech synthesis. Its optional Feishu integration needs permission to upload an OPUS resource and send that resource to an explicitly selected chat. It does not inherently need permission to enumerate every chat visible to the bot. The `list-chats` convenience command instructs users to grant `im:c ...[truncated 1742 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This mismatch combines two security-relevant issues: undisclosed Feishu data transmission and the absence of the claimed core translation/analysis functionality. A skill that primarily performs external chat operations while presenting itself as a benign learning helper can mislead operators and users about where their data goes and what the skill actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This mismatch combines two security-relevant issues: undisclosed Feishu data transmission and the absence of the claimed core translation/analysis functionality. A skill that primarily performs external chat operations while presenting itself as a benign learning helper can mislead operators and users about where their data goes and what the skill actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This mismatch combines two security-relevant issues: undisclosed Feishu data transmission and the absence of the claimed core translation/analysis functionality. A skill that primarily performs external chat operations while presenting itself as a benign learning helper can mislead operators and users about where their data goes and what the skill actually does.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
先检查环境变量 `SENSEAUDIO_API_KEY`。如果已经存在，直接使用；如果不存在，再提示用户提供 API Key 或先在终端设置环境变量。不要把密钥写进 `SKILL.md`、脚本源码或提交记录。

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is described as a language-learning translator with TTS, but this file adds Feishu chat enumeration and arbitrary outbound messaging capabilities. That scope expansion creates a channel to discover chats and post content outside the user’s immediate translation request, which is dangerous because it enables unauthorized dissemination or misuse of the bot in unrelated conversations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Listing all chats the bot has joined is unnecessary for a translation/pronunciation helper and exposes organizational metadata such as chat names, IDs, and descriptions. In the context of this skill, that capability broadens access well beyond the user’s request and can be used to map communication structure or target subsequent unauthorized messages.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/helper.py (reported line 16)May include surrounding context.
python
from pathlib import Path ROOT_DIR = Path(__file__).resolve().parent.parent _ENV_FILE = ROOT_DIR / ".env" _ENV_TEMPLATE = """\

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/main.py (reported line 158)May include surrounding context.
python
from pathlib import Path ROOT_DIR = Path(__file__).resolve().parent.parent _ENV_FILE = ROOT_DIR / ".env" _ENV_TEMPLATE = """\

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/feishu_api.py (reported line 98)May include surrounding context.
python
def _ensure_env_file(): """Create .env template if it does not exist.""" if _ENV_FILE.exists(): return _ENV_FILE.write_text(_ENV_TEMPLATE, encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/helper.py (reported line 31)May include surrounding context.
python
def _ensure_env_file(): """Create .env template if it does not exist.""" if _ENV_FILE.exists(): return _ENV_FILE.write_text(_ENV_TEMPLATE, encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/helper.py (reported line 38)May include surrounding context.
python
def _ensure_env_file(): """Create .env template if it does not exist.""" if _ENV_FILE.exists(): return _ENV_FILE.write_text(_ENV_TEMPLATE, encoding="utf-8")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/helper.py (reported line 590)May include surrounding context.
python
def _ensure_env_file(): """Create .env template if it does not exist.""" if _ENV_FILE.exists(): return _ENV_FILE.write_text(_ENV_TEMPLATE, encoding="utf-8")

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares capabilities that imply access to environment variables, filesystem, network, and shell execution, but it does not define an explicit tool/permission scope. That creates an over-privileged execution model where a caller may not realize the skill can read secrets, write files, invoke commands, and make outbound requests. In this context the risk is elevated because the skill handles API keys and can also send content to external services.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
which ffmpeg

若未安装：

macOS: brew install ffmpeg

Linux: sudo apt install ffmpeg

text
## 内置音色映射

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Obtaining Feishu tenant tokens via FEISHU_APP_ID and FEISHU_APP_SECRET is not justified by the manifest’s narrowly stated purpose of translating text, producing pronunciation audio, and analyzing grammar. Environment-backed third-party messaging credentials introduce an external integration capability unrelated to the declared language-helper context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code uploads a local file to Feishu without any visible user-facing disclosure, consent, or restriction in this module. Even if intended for generated OPUS output, the function accepts an arbitrary path and could exfiltrate local file contents to an external service if called improperly elsewhere in the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Sending an audio message to a Feishu chat without an explicit confirmation path allows the skill to perform an external side effect on behalf of the user silently. In a language-learning context, that is risky because it can spam chats, leak generated content to unintended recipients, or be repurposed for unauthorized outbound communication.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
_load_dotenv() API_URL = "https://api.senseaudio.cn/v1/t2a_v2" MODEL_NAME = "SenseAudio-TTS-1.0" FALLBACK_VOICE_IDS = ["child_0001_b", "male_0004_a", "male_0018_a"] RETRYABLE_HTTP_STATUS_CODES = {500, 502, 503, 504}

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/helper.py (reported line 57)May include surrounding context.
python
_load_dotenv() API_URL = "https://api.senseaudio.cn/v1/t2a_v2" MODEL_NAME = "SenseAudio-TTS-1.0" FALLBACK_VOICE_IDS = ["child_0001_b", "male_0004_a", "male_0018_a"] RETRYABLE_HTTP_STATUS_CODES = {500, 502, 503, 504}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The debug logging captures full input text, payloads, request metadata, and raw response bodies, which can contain sensitive user-provided content and operational details. If debug logs are enabled, this creates a clear data exposure risk through local files without minimization or redaction of text content.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes translating user text, generating pronunciation audio via SenseAudio TTS, and providing grammar analysis. This file additionally exposes a separate concat command that executes an external binary (ffmpeg) to merge arbitrary audio files, which is a broader media-processing capability not declared in the stated purpose.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/helper.py (reported line 760)May include surrounding context.
python
ffmpeg = "ffmpeg" try: subprocess.run( [ffmpeg, "-version"], check=True, stdout=subprocess.DEVNULL,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/helper.py (reported line 782)May include surrounding context.
python
ffmpeg, "-y", "-f", "concat", "-safe", "0", "-i", str(manifest), "-c", "copy", str(output), ] result = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace") if result.returncode != 0: raise SystemExit(result.stderr.strip() or "ffmpeg concat failed.")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill imports Feishu chat enumeration and message-sending capabilities even though its stated purpose is language learning with TTS support. This expands the tool's ability to interact with external communications systems, increasing the risk of unintended data disclosure or misuse beyond user expectations.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/main.py (reported line 80)May include surrounding context.
python
"-c:a", "libopus", "-b:a", "32k", str(opus_path), ] result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) if result.returncode != 0: raise RuntimeError(f"ffmpeg WAV->OPUS failed:\n{result.stderr}") return str(opus_path)

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Tp4

Tp4

Tp4

Ae1

Description-Behavior Mismatch

Context-Inappropriate Capability

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Sudo/Root Execution

若未安装：

macOS: brew install ffmpeg

Linux: sudo apt install ffmpeg

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

Missing User Warnings

Context-Inappropriate Capability

subprocess module call

subprocess module call

Description-Behavior Mismatch

subprocess module call

Static analysis