feishu voice reply

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:10 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it claims, but it asks for and uses sensitive messaging credentials while also carrying avoidable installation and input-handling risks.

Review this skill before installing. Use only non-sensitive text, confirm the Feishu recipient and app permissions, remove the unused contact-read permission if possible, avoid running npm install unless the dependency is removed or pinned, and store Volcengine and Feishu credentials in a protected secrets mechanism.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: package.json:30

Finding

Unpinned and Unnecessary npm Dependency

Content

View full analysis

Remediation

View remediation

/dev/null 2>&1; then echo "ffmpeg is required" >&2 exit 1 fi ``` 3. If a JavaScript dependency later becomes necessary, pin an exact reviewed version rather than using `*`. 4. Commit a lockfile and use reproducible installation commands such as `npm ci`. 5. Disable lifecycle scripts where they are not required and incorporate dependency integrity and vulnerability scanning into release workflows. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu-voice-reply.sh:77

Finding

Unsafe JSON Construction from User-Controlled Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/feishu-voice-reply.sh:55

Finding

Predictable Temporary Audio Files in Shared Directory

Content

View full analysis

/dev/null } trap cleanup EXIT ``` The paths are subsequently used as output destinations: ```bash echo "$RESPONSE" | jq -r '.data' | base64 -d > "$TMP_MP3" ffmpeg -i "$TMP_MP3" -c:a libopus -b:a 32k "$TMP_OPUS" -y 2>/dev/null ``` ### Technical Analysis The temporary filenames are derived from the process ID and placed directly in the shared `/tmp` directory. Process IDs are predictable, and the script does not securely create the files before use with `mktemp`. A local attacker can attempt to create symbolic links at the predicted paths before the script opens them. Shell redirection follows symbolic links, and `ffmpeg -y` allows overwriting its output destination. Consequently, a link may redirect generated data into another file writable by the victim account. The script also does not set a restrictive `umask`. Depending on the user’s existing configuration, temporary voice content may be readable by other local users while the script is running. ### Attack Path 1. A local attacker observes process activity or predicts a likely upcoming process ID. 2. The attacker creates `/tmp/voice-tts-.mp3` or `/tmp/voice-tts-.opus` as a symbolic link to a file writable by the victim. 3. The victim starts the skill under the predicted process ID. 4. Shell redirection or `ffmpeg -y` follows the attacker-created symbolic link. 5. The target file is truncated or overwritten with generated audio data. 6. Alternatively, another local user reads temporary speech content when filesystem permissions permit it. ### Impact Assessment Exploitation requires local access and favorable timing. It can overwrite or corrupt files writable ...[truncated 313 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:58

Finding

Unnecessary Feishu Contact-Read Permission Violates Least Privilege

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (28)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

1. 配置环境变量

bash

# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

1. 配置环境变量

bash

# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

1. 配置环境变量

bash

# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/feishu-voice-config.json (reported line 47)May include surrounding context.

json

### 1. 配置环境变量

```bash
# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 31)May include surrounding context.

sh

### 1. 配置环境变量

```bash
# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 37)May include surrounding context.

sh

### 1. 配置环境变量

```bash
# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 44)May include surrounding context.

sh

### 1. 配置环境变量

```bash
# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 50)May include surrounding context.

sh

### 1. 配置环境变量

```bash
# 编辑 ~/.openclaw/.env 文件
nano ~/.openclaw/.env

# 添加以下内容（替换为你的实际配置）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

md

| 错误信息 | 原因 | 解决方案 |
|---------|------|----------|
| `resource ID is mismatched` | 音色不在资源包中 | 更换可用音色 |
| `99991661` | 缺少 access token | 检查飞书应用配置 |
| `ffmpeg not found` | 未安装 ffmpeg | `sudo apt install ffmpeg` |
| `VOLC_API_KEY not set` | 未配置环境变量 | 设置环境变量 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

| 错误信息 | 原因 | 解决方案 |
|---------|------|----------|
| `resource ID is mismatched` | 音色不在资源包中 | 更换可用音色 |
| `99991661` | 缺少 access token | 检查飞书应用配置 |
| `ffmpeg not found` | 未安装 ffmpeg | `sudo apt install ffmpeg` |
| `VOLC_API_KEY not set` | 未配置环境变量 | 设置环境变量 |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md

echo "✅ Opus 转换成功 ($(ls -lh "$TMP_OPUS" | awk '{print $5}'))"

# 步骤 3：获取飞书 Tenant Access Token
echo "⏳ 步骤 3/5: 获取飞书 Access Token..."
TOKEN_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 115)May include surrounding context.

sh

echo "✅ Opus 转换成功 ($(ls -lh "$TMP_OPUS" | awk '{print $5}'))"

# 步骤 3：获取飞书 Tenant Access Token
echo "⏳ 步骤 3/5: 获取飞书 Access Token..."
TOKEN_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 116)May include surrounding context.

sh

echo "✅ Opus 转换成功 ($(ls -lh "$TMP_OPUS" | awk '{print $5}'))"

# 步骤 3：获取飞书 Tenant Access Token
echo "⏳ 步骤 3/5: 获取飞书 Access Token..."
TOKEN_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 132)May include surrounding context.

sh

echo "✅ Opus 转换成功 ($(ls -lh "$TMP_OPUS" | awk '{print $5}'))"

# 步骤 3：获取飞书 Tenant Access Token
echo "⏳ 步骤 3/5: 获取飞书 Access Token..."
TOKEN_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

md

|---------|------|----------|
| `resource ID is mismatched` | 音色不在资源包中 | 更换可用音色 |
| `99991661` | 缺少 access token | 检查飞书应用配置 |
| `ffmpeg not found` | 未安装 ffmpeg | `sudo apt install ffmpeg` |
| `VOLC_API_KEY not set` | 未配置环境变量 | 设置环境变量 |

## 📖 使用示例

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash

# 安装 ffmpeg（用于音频格式转换）
# Ubuntu/Debian
sudo apt install ffmpeg

# macOS
brew install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 安装 ffmpeg（用于音频格式转换）
# Ubuntu/Debian
sudo apt install ffmpeg

# macOS
brew install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation describes sending user-provided text to Volcengine TTS and then delivering the resulting audio through Feishu, but it does not clearly warn users that their input leaves the local environment and is transmitted to third-party services. This creates a privacy and data-handling risk because users may provide sensitive content without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This request sends raw user text to an external TTS provider, which is a genuine data exfiltration surface if the input may contain secrets, personal data, or internal content. In an automation/agent setting, external transmission is more dangerous because upstream callers may not realize their data is being forwarded off-platform.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 73)May include surrounding context.

sh

# 步骤 1：生成 TTS 音频
echo "⏳ 步骤 1/5: 生成火山引擎 TTS 音频..."
RESPONSE=$(curl -sL -X POST 'https://openspeech.bytedance.com/api/v3/tts/unidirectional' \
  -H "x-api-key: $VOLC_API_KEY" \
  -H "X-Api-Resource-Id: $VOLC_RESOURCE_ID" \
  -H 'Content-Type: application/json' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits user-supplied text to Volcengine TTS and then uploads the generated audio to Feishu, but it provides no explicit consent, privacy notice, or data-classification guardrail before sending potentially sensitive content to third-party services. In an agent skill context, this increases the risk of unintentional disclosure of confidential prompts, personal data, or internal business information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 117)May include surrounding context.

sh

# 步骤 3：获取飞书 Tenant Access Token
echo "⏳ 步骤 3/5: 获取飞书 Access Token..."
TOKEN_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json' \
  -d "{
    \"app_id\": \"$FEISHU_APP_ID\",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This request sends a message to an external Feishu recipient using a caller-provided or environment-derived user ID, which can cause unintended disclosure of generated content to the wrong party if inputs are mistaken or manipulated. In a skill context, this is more sensitive because automated workflows may trigger outbound messaging without an explicit human review step.

Content

Scanner excerpt · scripts/feishu-voice-reply.sh (reported line 166)May include surrounding context.

sh

exit 1
fi

SEND_RESPONSE=$(curl -sL -X POST 'https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d "{

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The entire skill documentation is presented only in Chinese, including usage instructions and examples, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill name, trigger phrases, and usage examples are all Chinese-specific, which effectively constrains invocation to a single language. The file does not indicate that this is an optional locale setting or a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This JSON contains user-facing natural-language descriptions and a documentation URL explicitly pinned to the Chinese locale (lang=zh), and all labels/instructions are written only in Chinese. Under the policy, forcing a specific language or locale without user opt-in can be a violation unless the locale constraint is clearly documented and justified; this file does not provide such justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.