Voice AB Lab

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:05 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stated voice A/B testing purpose, but it has unsafe helper loading, broad credential use, and Feishu delivery paths that need review before installation.

Install only if you are comfortable sending briefs, transcripts, and generated copy to SenseAudio and optionally sending generated audio to Feishu. Use dedicated API and Feishu credentials, provide explicit chat IDs, review result JSON before Feishu delivery, and avoid running it in workspaces containing unrelated private audio until path validation and helper-loading issues are fixed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/send_ab_variants_to_feishu.py:134

Finding

Arbitrary Local Audio File Disclosure Through Feishu Delivery

Content

View full analysis

Vulnerability Details

File Location: scripts/send_ab_variants_to_feishu.py, lines 134-183
Vulnerability Type: Unvalidated local file reference leading to data disclosure
Risk Level: High

Vulnerable Code

python

tts_results_path = Path(args.tts_results).expanduser().resolve()
summary = load_json(tts_results_path)
selected_results = filter_results(summary.get("results") or [], args.variant_ids, args.limit)
if not selected_results:
    raise SystemExit("no variants selected for Feishu sending")

workspace_root = Path(args.workspace_root).expanduser().resolve()
config = feishu_sender.load_feishu_config(Path(args.config_path).expanduser())
chat_id, session_path = feishu_sender.infer_chat_id(
    workspace_root,
    args.chat_id.strip(),
    args.session_file.strip(),
)
tenant_token = feishu_sender.fetch_tenant_token(
    config["app_id"],
    config["app_secret"],
)

deliveries = []
for index, item in enumerate(selected_results, start=1):
    source_path = Path(str(item.get("out_path") or "")).expanduser().resolve()
    if not source_path.exists():
        raise SystemExit(f"missing synthesized audio file: {source_path}")

    target_name = (
        f"{item.get('variant_id', f'V{index:02d}')}_"
        f"{slugify(str(item.get('tone') or 'tone'))}_"
        f"{slugify(str(item.get('regional_style') or 'style'))}.ogg"
    )
    target_path = prepared_dir / target_name
    transcode_to_ogg(source_path, target_path, ffmpeg_exe=ffmpeg_exe)

    duration_ms = (((item.get("extra_info") or {}).get("audio_length")) or None)
    upload = feishu_sender.upload_audio(target_path, tenant_token, duration_ms)
    file_key = (((upload.get("data") or {}).get("file_key")) or "").strip()
    if not file_key:
        raise SystemExit(
            f"upload response missing file_key: {json.dumps(upload, ensure_ascii=False)}"
        )
    send = feishu_sender.send_audio_message(chat_
...[truncated 2195 chars]

Remediation

View remediation

Remediation Suggestions

1. Derive the permitted source directory from a trusted pipeline output rather than from caller-controlled JSON.
2. Resolve both the trusted root and candidate path, then require the candidate to remain inside that root:

   python

   trusted_root = tts_results_path.parent.resolve()
   source_path = Path(str(item.get("out_path") or "")).expanduser().resolve(strict=True)
   
   if not source_path.is_relative_to(trusted_root):
       raise SystemExit("audio source is outside the trusted TTS output directory")
   

3. Require source_path.is_file() and reject symbolic links before reading or transcoding.
4. Build the allowed file list from a trusted manifest generated during the same pipeline invocation.
5. Require explicit recipient confirmation before sending to an inferred chat, especially when no --chat-id was supplied.
6. Use narrowly scoped Feishu application permissions limited to uploading media and sending messages only where necessary.
7. Record a non-sensitive audit event containing the validated source identifier and destination chat without logging credentials or tenant tokens.

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/send_ab_variants_to_feishu.py:35

Finding

Ancestor-Directory Module Discovery Enables Local Tool Hijacking

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/batch_tts_variants.py, lines 13-28
• scripts/senseaudio_asr.py, lines 16-31
• scripts/run_spoken_brief_pipeline.py, lines 10-24
• scripts/run_typed_brief_pipeline.py, lines 10-24
• scripts/send_ab_variants_to_feishu.py, lines 14-53

Vulnerability Type: Untrusted Python module discovery and execution
Risk Level: High

Vulnerable Code

From the SenseAudio bootstrap logic:

python

def _bootstrap_shared_senseaudio_env() -> None:
    current = Path(__file__).resolve()
    for parent in current.parents:
        candidate = parent / "_shared" / "senseaudio_env.py"
        if candidate.exists():
            candidate_dir = str(candidate.parent)
            if candidate_dir not in sys.path:
                sys.path.insert(0, candidate_dir)
            from senseaudio_env import ensure_senseaudio_env
            ensure_senseaudio_env()
            return


_bootstrap_shared_senseaudio_env()

from senseaudio_api_guard import ensure_runtime_api_key

From the Feishu helper loader:

python

def load_helper_module(skill_name: str, script_name: str, alias: str) -> Any:
    current = Path(__file__).resolve()
    for parent in current.parents:
        candidate = parent / skill_name / "scripts" / script_name
        if candidate.exists():
            spec = importlib.util.spec_from_file_location(alias, candidate)
            if spec and spec.loader:
                module = importlib.util.module_from_spec(spec)
                spec.loader.exec_module(module)
                return module
    raise SystemExit(f"could not locate {skill_name}/scripts/{script_name}")


feishu_sender = load_helper_module(
    "audioclaw-skills-voice-reply",
    "feishu_audio_sender.py",
    "audioclaw_feishu_sender",
)

Technical Analysis

The scripts search every ancestor of their installed location for files with expe ...[truncated 2148 chars]

Remediation

View remediation

Remediation Suggestions

1. Package required helpers as versioned dependencies and import them through a fixed, trusted package namespace.
2. Remove ancestor traversal and avoid modifying sys.path at runtime.
3. If local dynamic loading is unavoidable, resolve helpers relative to a single trusted application root supplied by trusted configuration.
4. Verify helper ownership, permissions, and a pinned cryptographic digest before loading.
5. Reject helper files or parent directories writable by untrusted users.
6. Pin dependency versions and validate them during installation.
7. Load each expected function from audited code rather than granting an entire dynamically located module execution rights.
8. Keep API credentials unavailable until after dependency integrity has been established.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_tts_variants.py:139

Finding

Unsanitized Variant Identifiers Permit Output Path Traversal

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/batch_tts_variants.py, lines 139-142
• scripts/send_ab_variants_to_feishu.py, lines 162-168

Vulnerability Type: Path traversal and arbitrary file overwrite
Risk Level: High

Vulnerable Code

In the TTS batch writer:

python

filename = (
    f"{item['variant_id']}_"
    f"{slugify(item['tone'])}_"
    f"{slugify(item['regional_style'])}.mp3"
)
out_path = outdir / filename
out_path.write_bytes(audio_bytes)

In the Feishu transcoding stage:

python

source_path = Path(str(item.get("out_path") or "")).expanduser().resolve()
if not source_path.exists():
    raise SystemExit(f"missing synthesized audio file: {source_path}")

target_name = (
    f"{item.get('variant_id', f'V{index:02d}')}_"
    f"{slugify(str(item.get('tone') or 'tone'))}_"
    f"{slugify(str(item.get('regional_style') or 'style'))}.ogg"
)
target_path = prepared_dir / target_name
transcode_to_ogg(source_path, target_path, ffmpeg_exe=ffmpeg_exe)

The transcoding function subsequently overwrites its target and changes its permissions:

python

command = [
    ffmpeg_exe,
    "-y",
    "-i",
    str(source_path),
    "-vn",
    "-ac",
    "1",
    "-ar",
    "24000",
    "-c:a",
    "libopus",
    "-b:a",
    "48k",
    str(target_path),
]
subprocess.run(command, check=True, capture_output=True, text=True)
os.chmod(target_path, 0o644)

Technical Analysis

The tone and regional_style portions are passed through slugify(), but variant_id is inserted into output filenames without validation. Both the manifest supplied to batch_tts_variants.py and the TTS results supplied to the Feishu script can contain attacker-controlled variant identifiers.

Path separators and parent-directory components in variant_id remain active when the final path is joined to outdir or prepared_dir. Neither script resolv ...[truncated 1713 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate variant_id using a strict allowlist such as [A-Za-z0-9_-]+.
2. Apply slugify() to every filename component, including variant_id.
3. Resolve the destination and enforce containment before writing:

   python

   root = outdir.resolve()
   safe_id = slugify(str(item["variant_id"]))
   destination = (root / f"{safe_id}_{safe_tone}_{safe_style}.mp3").resolve()
   
   if not destination.is_relative_to(root):
       raise SystemExit("invalid output path")
   

4. Reject absolute paths, path separators, . and .. components, NUL characters, and empty identifiers.
5. Detect and reject symbolic-link destinations and symlinked parent directories.
6. Avoid FFmpeg's unconditional -y overwrite behavior unless overwriting a known pipeline-generated file.
7. Create output files with restrictive permissions, such as 0600, unless broader local readability is explicitly required.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_ab_review_csv.py:22

Finding

CSV Formula Injection in A/B Review Exports

Content

View full analysis

Vulnerability Details

File Location: scripts/export_ab_review_csv.py, lines 22-49
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

Vulnerable Code

python

rows = []
for item in manifest["variants"]:
    audio = result_map.get(item["variant_id"], {})
    extra = audio.get("extra_info") or {}
    rows.append(
        {
            "campaign_name": manifest.get("campaign_name", ""),
            "variant_id": item["variant_id"],
            "tone": item["tone"],
            "regional_style": item["regional_style"],
            "voice_id": audio.get("voice_id", ""),
            "estimated_points": item.get("estimated_points", ""),
            "audio_length_ms": extra.get("audio_length", ""),
            "usage_characters": extra.get("usage_characters", ""),
            "audio_path": audio.get("out_path", ""),
            "hook_score_1_5": "",
            "clarity_score_1_5": "",
            "conversion_score_1_5": "",
            "regional_fit_score_1_5": "",
            "review_notes": "",
            "text": item["text"],
        }
    )

out_path = Path(args.out_csv)
out_path.parent.mkdir(parents=True, exist_ok=True)
with out_path.open("w", encoding="utf-8-sig", newline="") as f:
    writer = csv.DictWriter(f, fieldnames=list(rows[0].keys()))
    writer.writeheader()
    writer.writerows(rows)

Technical Analysis

Values originating from the manifest and TTS results are exported directly to CSV. Fields such as campaign_name, variant_id, tone, regional_style, voice_id, audio_path, and text can contain attacker-controlled strings.

Spreadsheet applications may interpret cells beginning with =, +, -, or @ as formulas. Standard CSV quoting only preserves field boundaries; it does not neutralize formula interpretation.

As a result, a review CSV can contain formulas that execute when a reviewer opens the file in a comp ...[truncated 1346 chars]

Remediation

View remediation

Remediation Suggestions

1. Sanitize every string field before writing it to CSV.
2. Prefix cells whose first non-whitespace character is =, +, -, or @ with an apostrophe.
3. Account for leading tabs, carriage returns, newlines, and spaces that some spreadsheet applications ignore before formula detection.
4. Apply sanitization centrally to all exported values:

   python

   def safe_csv_cell(value):
       text = str(value)
       normalized = text.lstrip(" \t\r\n")
       if normalized.startswith(("=", "+", "-", "@")):
           return "'" + text
       return text
   

5. Consider exporting to a format that explicitly represents text cell types when the review workflow supports it.
6. Warn reviewers not to bypass protected-view or external-content warnings for files containing externally supplied campaign data.
7. Add tests covering formula prefixes, leading whitespace, tabs, and multiline values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (41)

Tainted flow: 'request' from os.getenv (line 82, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/batch_tts_variants.py (reported line 94)May include surrounding context.

python

)

        try:
            with urllib.request.urlopen(request, timeout=120) as response:
                audio_bytes, trace_id, extra_info, chunk_count = parse_sse_audio(response)
                return audio_bytes, trace_id, extra_info, chunk_count, model
        except urllib.error.HTTPError as exc:

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents an end-to-end workflow: create multiple voice variants from a typed or spoken brief, transcribe voice memos with AudioClaw ASR, and synthesize outputs with the same AudioClaw voice_id. The code only implements the final batch TTS step. It loads a manifest containing existing variants, calls the SenseAudio text-to-audio endpoint, saves MP3 files, and emits a results summary. There is no speech-to-text logic, no brief-to-variant generation, and the external service/provider differs materially from the declared one. That makes the description inaccurate relative to the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code’s core function is to generate Chinese ad-copy variants from structured brief inputs (product, audience, key message, offer, CTA, proof), applying tone and regional phrasing templates and outputting JSON. While this partially aligns with the 'generate multiple ... variants from one ... brief' portion of the description, the declared purpose prominently includes two major capabilities that are absent here: transcribing voice memos with AudioClaw ASR and synthesizing the variants using the same AudioClaw voice_id. The script contains no network/API calls, no audio input handling, no ASR, and no TTS/synthesis logic. Therefore the description materially overstates the behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an AudioClaw-based workflow for transcription and synthesis of multiple promo/voice variants from a brief. This code does not perform any of those core actions. It only loads two existing JSON files (manifest and TTS results), combines their fields, and writes a review CSV with placeholders for human scoring. While such a CSV export could support an A/B testing workflow, it is not the described primary capability and omits the central behaviors of generating variants, transcribing audio, and synthesizing speech.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The script clearly supports typed creative briefs: it accepts campaign/product/audience/message fields, generates variant manifests, and runs batch TTS with a selected voice ID. This aligns with the variant-generation and synthesis portion of the description. However, the declared purpose also says it can handle spoken briefs and transcribe voice memos with ASR, but this code chunk contains no audio input handling or transcription step. Additionally, it has an optional capability to send generated audio to Feishu, which is an undeclared external-sharing behavior. Because the missing ASR/spoken-brief functionality is a material part of the declared purpose, and there is an extra undeclared Feishu-sending capability, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description focuses on AudioClaw ASR transcription and TTS variant generation from a brief. This code chunk's primary purpose is different: distribution of already-generated voice variants to Feishu. It relies on external Feishu configuration, tenant authentication, chat/session inference, message sending, and audio upload. There is no implementation here for creative-brief expansion, ASR transcription, or TTS synthesis itself. While sending variants for A/B review could be adjacent to the broader workflow, the supplied code performs a distinct undeclared capability—external messaging/delivery—so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broader AudioClaw-based workflow: generate multiple sales/ad voice variants from a brief, transcribe voice memos, and synthesize variants using a consistent voice_id. The supplied code does only one narrow part of that concept: audio transcription. It targets SenseAudio, not AudioClaw, and contains no text generation, prompt/brief expansion, voice synthesis, voice_id management, or A/B testing orchestration. Because the primary purpose and external service differ materially from the declaration, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly states it will replace an injected token by reading the real sk-... secret from ~/.audioclaw/workspace/state/senseaudio_credentials.json. Direct access to local credential files is high risk because it expands secret exposure to the skill runtime and can enable credential theft, misuse, or lateral access if the environment or logs are compromised.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

Practical rule:
- `scripts/run_spoken_brief_pipeline.py`, `scripts/run_typed_brief_pipeline.py`, and `scripts/batch_tts_variants.py` now default to `SENSEAUDIO_API_KEY`
- If the host app injects `SENSEAUDIO_API_KEY` as a login token such as `v2.public...`, the shared bootstrap replaces it with the real `sk-...` value from `~/.audioclaw/workspace/state/senseaudio_credentials.json` before the synthesis step starts
- The ASR scripts keep their own existing defaults and are intentionally not changed here

## Resources

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_spoken_brief_pipeline.py (reported line 64)May include surrounding context.

python

skill_dir = Path(__file__).resolve().parent
    outdir = Path(args.outdir)
    outdir.mkdir(parents=True, exist_ok=True)
    env = os.environ.copy()

    transcript_json = outdir / "spoken_brief_transcript.json"
    brief_json = outdir / "spoken_brief_brief.json"

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_typed_brief_pipeline.py (reported line 68)May include surrounding context.

python

skill_dir = Path(__file__).resolve().parent
    outdir = Path(args.outdir)
    outdir.mkdir(parents=True, exist_ok=True)
    env = os.environ.copy()

    transcript_json = outdir / "spoken_brief_transcript.json"
    brief_json = outdir / "spoken_brief_brief.json"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill describes shell execution, local file access, environment-variable use, and networked API interactions but declares no explicit tool scope or permission boundary. In an agent environment, that makes the operational authority ambiguous and increases the risk of over-broad execution, unintended data access, or unsafe invocation of high-risk capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The workflow instructs saving user audio locally and optionally sending generated audio to Feishu, but provides no user-facing notice about retention, destination, or consent. Voice recordings and derived audio are sensitive data, and silent local storage plus third-party transmission can create privacy, compliance, and unintended disclosure risks.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

- similar script length
- Treat `regional_style` as a wording choice, not an official dialect model.
- Official clone support is a two-step chain:
  - create the clone on the AudioClaw platform first
  - then pass the prepared clone `voice_id` into this skill for generation

## API key lookup

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The prompt instructs the agent to automatically send generated variants one by one as Feishu audio messages once certain phrases are detected, replacing a normal reply with an external side effect. This creates unauthorized or insufficiently confirmed outbound communication risk, especially if user intent is inferred loosely, content is sent to the wrong recipient/channel, or generated audio contains sensitive or harmful material.

Content

Scanner excerpt · agents/openai.yaml (reported line 4)May include surrounding context.

yaml

interface:
  display_name: "Voice AB Lab"
  short_description: "Transcribe spoken briefs and batch-produce same-voice ad variants"
  default_prompt: "Use $senseaudio-voice-ab-lab to handle either a spoken or typed campaign brief, generate multiple spoken ad variants, synthesize them with the same AudioClaw voice, and when the user asks to试听、逐条发语音、或直接在飞书里听, automatically send the generated variants one by one as Feishu audio messages instead of replying with file paths."

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The default prompt says to use the skill to handle "either a spoken or typed campaign brief" and to act "when the user asks" for several outcomes, but it does not define specific trigger phrases, boundaries, or exclusion conditions. In a manifest file, this broad natural-language invocation guidance could overlap with ordinary requests and make it unclear when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The skill routes recorded spoken briefs to an external API endpoint, which can transmit sensitive business information or personal data off-platform. Because spoken briefs may contain campaign plans, customer data, or proprietary sales context, sending raw audio to a third-party service creates confidentiality, compliance, and data handling risk if users are not clearly informed and protected.

Content

Scanner excerpt · references/asr_brief_pipeline.md (reported line 8)May include surrounding context.

md

Official findings confirmed from AudioClaw-aligned sources:

- The public site exposes a speech recognition workspace at `/workspace/speech-recognition`.
- The official HTTP API endpoint is `POST https://api.senseaudio.cn/v1/audio/transcriptions`.
- Official open API models are `sense-asr-lite`, `sense-asr`, `sense-asr-pro`, `sense-asr-deepthink`.
- Open API request fields include `file`, `model`, optional `language`, and optional `response_format`.
- Official open API `response_format` supports `json` and `text`.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document presents a single recommended spoken brief format entirely in Chinese, which can impose a language expectation on users without opt-in or alternative locale guidance. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/batch_tts_variants.py (reported line 31)May include surrounding context.

python

from senseaudio_api_guard import ensure_runtime_api_key


API_URL = "https://api.senseaudio.cn/v1/t2a_v2"


def slugify(value: str) -> str:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/senseaudio_asr.py (reported line 34)May include surrounding context.

python

from senseaudio_api_guard import ensure_runtime_api_key


API_URL = "https://api.senseaudio.cn/v1/t2a_v2"


def slugify(value: str) -> str:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends arbitrary input text and a bearer-authenticated request to a third-party API without any explicit disclosure, confirmation, or privacy notice at runtime. In this skill context, creative briefs, ad copy, or transcribed voice memo content may contain sensitive commercial information, so silent transmission can cause unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes generated audio plus a JSON summary that includes the full original text for every variant, which can persist sensitive campaign content on disk without warning. In shared workstations, CI environments, or synced directories, this increases the risk of unintended disclosure of proprietary or regulated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated copy is always produced in Chinese, and the script includes fixed locale-specific variants such as north, south, and Taiwan styles. There is no opt-in, language selection, or documentation in this file indicating that the locale restriction is intentional or user-configurable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script ingests brief data, including a possible source transcript, and then writes the full result both to a file and to stdout. In this skill's context, creative briefs and transcribed voice memos can contain sensitive business plans, personal data, or unpublished campaign material, so unconditional echoing increases the risk of accidental disclosure through logs, terminals, CI output, or downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script persists the full transcript to the output JSON under source_transcript and also prints the full result to stdout, which can expose sensitive spoken content through files, logs, terminal history, or downstream pipeline capture. In this skill’s context, transcripts may contain marketing plans, pricing, customer targeting data, or incidental personal information from voice memos, making undisclosed broad propagation of raw transcript data a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The presence of Feishu delivery controls in a skill described primarily as transcription and voice-variant generation introduces a secondary exfiltration path for audio and metadata. In this context, spoken briefs may contain unreleased marketing plans, regional strategy, or customer data, so optional chat delivery meaningfully raises confidentiality risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.