T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:3- Finding
Mandatory Skill Invocation Hijacks Agent Output Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
千问语音合成
Security checks for vulnerabilities and agentic risk
Overview
This TTS skill has legitimate speech and Feishu delivery features, but it can over-share assistant output and use local credentials in ways that are not clearly disclosed.
Review carefully before installing. Use only in an environment where sending assistant text to DashScope and Feishu is acceptable, and avoid sensitive prompts or confidential outputs. Prefer a revised version that removes mandatory every-response use, requires explicit credentials and recipients, pins the Edge TTS dependency, and fixes temporary-file handling.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/speak_and_send.py:21- Finding
Undocumented Access to OpenClaw Credentials and Broad Authentication Configuration
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
scripts/speak_and_send.py:114- Finding
Unpinned npm Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/speak_and_send.py:164- Finding
Race-Prone Temporary Files Created with tempfile.mktemp
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/speak.sh:23- Finding
Predictable PID-Based Files in Shared Temporary Directory
- Content
View full analysis
/dev/null # 清理 rm -f "$TMP_WAV" ``` ### Technical Analysis The script constructs filenames from its process ID in the globally shared `/tmp` directory. Process IDs are observable or predictable, and neither file is atomically created with exclusive semantics. A local attacker can pre-create a symbolic link at the expected WAV or OGG path. `curl -o` and FFmpeg may then follow the attacker-controlled path. FFmpeg is explicitly passed `-y`, enabling overwrite without prompting. The final OGG file is intentionally retained as output, but it is stored in a shared location without a private directory or explicit restrictive permissions. ### Attack Path 1. A local attacker predicts or observes the shell process ID. 2. The attacker creates `/tmp/qwen_tts_.wav` or `/tmp/qwen_tts_.ogg` as a symbolic link. 3. `curl` writes downloaded audio to the WAV path, or FFmpeg writes converted audio to the OGG path. 4. The linked target may be overwritten if it is writable by the Skill's user. 5. Alternatively, the attacker can capture, replace, or corrupt the generated audio. ### Impact Assessment The vulnerability can cause user-level file overwrite, generated-audio disclosure, content tampering, or denial of service. The accessible scope is limited to files and resources available to the account executing the script, but no elevated account is required to attack another process using a shared temporary directory when directory permissions and symlink handling permit it. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description promises mandatory use before every response, external sending behavior, a specific preferred voice/model, and an Edge TTS fallback, but the documented behavior does not consistently implement those guarantees. Security-relevant behavior mismatches are dangerous because operators and users may rely on controls, routing, or data handling assumptions that are not actually enforced.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The script accesses a local secrets file containing Feishu credentials and uses them to obtain a tenant token for messaging. In an agent skill, automatic credential discovery and use is particularly sensitive because it enables authenticated actions against external systems without requiring the operator to intentionally supply the secret at execution time.
- Content
python session.trust_env = False # ====== 飞书 Bot 配置（从文件读取）====== CREDS_FILE = os.path.expanduser("~/.openclaw/credentials/lark.secrets.json") CONFIG_FILE = os.path.expanduser("~/.openclaw/openclaw.json") def get_feishu_config():
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill documents capabilities that require network access, environment variable access, shell execution, and local file output, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent runtime will invoke the skill with broader privileges than users expect, reducing transparency and weakening least-privilege controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill is designed to send user-provided text to an external TTS provider and may additionally forward generated audio to Feishu, but the description lacks a prominent warning and consent boundary for that transmission. In an agent setting, this can lead to unintended disclosure of sensitive prompts, personal data, or confidential outputs to third-party services.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The instruction that this skill 'must' be used before every output forces automatic externalization of all responses into audio without user choice. That design materially increases privacy and safety risk because even low-risk text workflows become mandatory network transmissions and possible message delivery events.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
基本语音合成（同步接口）
使用 curl 调用千问 TTS：
bash curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \ -H "Authorization: Bearer $DASHSCOPE_API_KEY" \ -H 'Content-Type: application/json' \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
请求示例
bash curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \ -H "Authorization: Bearer $DASHSCOPE_API_KEY" \ -H 'Content-Type: application/json' \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
通过文本描述创建全新音色，适合品牌定制：
bash curl -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \ -H "Authorization: Bearer $DASHSCOPE_API_KEY" \ -H 'Content-Type: application/json' \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file documents a voice cloning capability that can replicate a real person's voice but provides no safety guidance about consent, impersonation, fraud, or legal/ethical restrictions. In a TTS skill whose purpose is to convert and send audio output, this omission materially increases the risk of misuse for deception or unauthorized identity replication.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest says the skill's core purpose is to convert text to speech and send it out, and even states it must be used before each output result. However, the script documentation explicitly says it only generates a local audio file and does not send to Feishu, and the implementation ends by printing the local OGG path rather than delivering the audio anywhere.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The comments state '仅生成本地音频文件，不发送飞书' and emphasize that only the TTS API key is needed, which directly conflicts with the skill description that its core purpose is to convert text to speech and send it out. This is an active contradiction between code documentation and the stated skill intent, not merely an omitted detail.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sets LANG to Chinese by default, which imposes a language/locale choice unless the caller explicitly overrides it. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless clearly justified as region-specific.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The script sends input text and an authorization bearer token to an external network service, which creates a real data exposure boundary. Given the skill description says this should be used before every output, the context increases risk because routine assistant responses may contain sensitive or user-specific content that is automatically transmitted off-host.
- Content
sh TMP_OGG="/tmp/qwen_tts_$$.ogg" # 调用千问 API RESPONSE=$(curl -s -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \ -H "Authorization: Bearer $API_KEY" \ -H 'Content-Type: application/json' \ -d "$(jq -n --arg text "$TEXT" --arg voice "$VOICE" --arg lang "$LANG" '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script transmits user-provided text to a third-party TTS service without any inline notice, consent checkpoint, or content sensitivity guard. In a skill whose core purpose is to convert potentially arbitrary assistant output into speech, this can expose confidential, personal, or sensitive data to an external provider whenever the script is invoked.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill reaches into unrelated local credential/config files and shell startup files to harvest Feishu and DashScope secrets, which exceeds a narrowly stated TTS function and creates unnecessary credential exposure. In this skill context, the risk is elevated because the code also sends data to external services, so local secret discovery directly enables outbound use of those credentials without explicit user mediation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script searches ~/.zshrc and ~/.bashrc for DASHSCOPE_API_KEY, then transmits user-provided text and derived audio to third-party services and Feishu without any user-facing disclosure or consent check. This is dangerous because it silently expands its access to sensitive local data and combines that with outbound transmission, creating privacy and credential-handling risks beyond what a minimal TTS helper should do.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The TTS request explicitly sets language_type to "Chinese", and the fallback voice is also a Chinese-specific voice, while the file does not indicate that this is a region-specific or Chinese-only skill. This forces a locale/language behavior without user opt-in, which matches the policy violation criteria.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ogg_path = tempfile.mktemp(suffix=".ogg") # 调用 Edge TTS，移除了 --timeout 参数避免 Node.js 内部报错 result = subprocess.run( ["npx", "node-edge-tts", "-t", text, "-f", mp3_path,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python print(f"Edge TTS 警告（文件已生成）: {result.stderr[:100]}") # 转换为 OGG (opus) conv_result = subprocess.run([ "ffmpeg", "-i", mp3_path, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path, "-y"
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ogg_path = tempfile.mktemp(suffix=".ogg") # 生成1.5秒静音 subprocess.run([ "ffmpeg", "-f", "lavfi", "-i", "anullsrc=r=48000:cl=mono", "-t", "1.5", silence_path, "-y" ], capture_output=True)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 72% confidence
- Finding
This ffmpeg concat invocation consumes a list file built from paths created with tempfile.mktemp and runs with '-safe 0', reducing ffmpeg's path safety checks. In combination with insecure temporary-file creation, a local attacker on the same system could race or pre-create paths/symlinks and influence what files ffmpeg reads or overwrites, making the skill more dangerous because it handles local files automatically before exfiltrating results onward.
- Content
python f.write(f"file '{wav_path}'\n") f.write(f"file '{silence_path}'\n") subprocess.run([ "ffmpeg", "-f", "concat", "-safe", "0", "-i", concat_list, "-c:a", "libopus", "-b:a", "64k", "-ar", "48000", ogg_path, "-y"
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script reads DASHSCOPE_API_KEY from the environment and only reports an error if it is missing. There is no comment or user-facing warning explaining that a sensitive API credential will be used to authenticate requests to a third-party service.
- Content