可接入飞书的senseaudio角色扮演助手

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

The skill’s Feishu voice-companion purpose is coherent, but it broadly processes private chat content and silently installs a Python package during runtime.

Review before installing. Use a dedicated low-permission Feishu bot, restrict it to intended chats, assume voice audio and generated replies may be processed by SenseAudio and Feishu, and preinstall pinned dependencies instead of allowing runtime pip installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        pass

    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", pip_name],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

• Confidence: 94% confidence
• Finding: The code automatically runs `pip install` at runtime if `requests` is missing, which modifies the host Python environment and executes installation logic from an external package index. Even though the package name is currently hardcoded to `requests`, this creates supply-chain and operational risk that is unnecessary for a voice-reply skill and can be abused if package sources or the environment are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        pass

    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", pip_name],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

• Confidence: 92% confidence
• Finding: The code automatically invokes pip at runtime to install a package if import fails. This expands the attack surface by permitting unreviewed code to be fetched and executed in the skill's runtime environment, which can lead to supply-chain compromise or unexpected code execution if package sources or names are manipulated.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        pass

    result = subprocess.run(
        [sys.executable, "-m", "pip", "install", pip_name],
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,

• Confidence: 95% confidence
• Finding: The code automatically runs `pip install` at runtime when `requests` is missing. Even though `subprocess.run` is invoked without a shell, this still grants the skill package-installation capability, which can execute arbitrary installer code from PyPI and mutate the host environment without explicit approval. In an agent skill handling chat content, that is an unnecessary and risky privilege escalation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares powerful capabilities in its content and workflow—environment variable access, local file persistence, shell execution, and outbound network use—but does not declare permissions accordingly. This weakens review and consent boundaries because operators may enable a skill without understanding that it stores persona/audio data locally and sends content to Feishu and SenseAudio. In this context, the mismatch is more concerning because the skill handles private chat content and voice data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The description promises an automatically triggered Feishu companion flow, but the documented behavior is actually a set of manual CLI operations, local persistence, and external ASR/TTS calls. That mismatch is security-relevant because users and reviewers may misunderstand what data is stored, when the skill runs, and what external services receive chat or audio content. The hidden persistence of persona/audio artifacts especially increases privacy and governance risk.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Dynamically installing Python packages during execution is not required for ASR functionality and introduces avoidable supply-chain risk. It also permits unexpected environment changes at runtime, which is particularly risky in agent or bot deployments where code should be deterministic and pre-vetted.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Auto-installing Python packages during normal execution is not required for the stated Feishu voice reply function and causes the skill to change its own execution environment. This behavior can introduce malicious or vulnerable dependencies at runtime and makes deployments non-reproducible and harder to audit.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Auto-installing Python packages at runtime is not necessary for normal TTS functionality and introduces code execution through package installation. A compromised package source, dependency confusion event, or accidental installation of an unexpected version could lead to arbitrary code execution on the host. The companion-chat context makes this more dangerous because the skill otherwise only needs network I/O and audio processing, not software installation privileges.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that user voice is transcribed by SenseAudio ASR and replies are synthesized through external services, but it does not mention any user-facing notice, consent flow, or data handling expectations. In a private-chat companion context, users may share highly sensitive emotional or personal content, so undocumented third-party transmission increases privacy and compliance risk.

Vague Triggers

High

• Confidence: 84% confidence
• Finding: The skill is described as triggering on any text or voice message in Feishu bot private chats, which is overly broad for a feature that forwards content to external ASR/TTS services and stores persona state. Broad triggers increase the chance of processing sensitive or unintended content without meaningful user intent on each message. In a companion-chat context, this is especially risky because conversations are likely to contain emotional, personal, or confidential material.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly describes persistent storage of persona data and transmission of user text/audio to external services, but provides no privacy notice, retention policy, or explicit data-handling warning. This creates a real privacy vulnerability because highly personal conversations and voice samples may be stored locally and sent off-platform without informed consent. The companion/roleplay use case makes this more dangerous, not less, because users may disclose intimate information.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The function uploads user-provided audio to a third-party ASR service without any visible consent, disclosure, minimization, or trust-boundary checks in this code path. In a companion/voice-chat skill, audio can contain highly sensitive personal or emotional content, so undisclosed external transmission increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code changes the runtime environment by installing a package via subprocess without prior operator approval in the execution flow. Silent environment mutation reduces deployment predictability and opens a path for unwanted package retrieval from external sources.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill changes the execution environment by installing packages without any user or administrator-facing confirmation. Silent package installation undermines transparency and can surprise operators, making unsafe state changes harder to detect and review. Combined with pip's ability to execute package setup/build logic, this becomes a meaningful security concern rather than just a UX issue.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.