千问语音合成

• Outcome: Review
• Latest audit: Aug 31, 2026 · 3:44 PM UTC
• Version: 1.0.0

Overview

This TTS skill is mostly purpose-aligned, but it can automatically transmit outputs to third-party services while using local app credentials and shell profile secrets that are not clearly disclosed.

Review this before installing if your agent may handle private, business, or credential-like text. Use it only with content you are comfortable sending to DashScope and Feishu, and prefer explicit, dedicated credentials rather than allowing the script to reuse existing OpenClaw or shell-profile secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (14)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f.write(f"file '{wav_path}'\n")
        f.write(f"file '{silence_path}'\n")
    
    subprocess.run([
        "ffmpeg", "-f", "concat", "-safe", "0", "-i", concat_list,
        "-c:a", "libopus", "-b:a", "64k", "-ar", "48000",
        ogg_path, "-y"

• Confidence: 68% confidence
• Finding: Although shell injection is not present, this ffmpeg concat invocation consumes a concat manifest built from temp file paths using -safe 0. Because tempfile.mktemp is used elsewhere to create predictable paths before opening them, a local attacker could race or precreate path targets and influence what ffmpeg reads. In a skill that automatically processes and exfiltrates audio, that increases the danger of unintended local file access or processing of attacker-supplied files.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities that require environment-variable access, shell execution, local file creation, and outbound network access, but it does not declare those permissions explicitly. This creates a transparency and governance gap: a host system or user may authorize the skill without realizing it can exfiltrate content to third parties or write artifacts locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The declared purpose emphasizes TTS generation, but the documented behavior also includes reading Feishu credentials, obtaining access tokens, uploading audio, and sending messages to a user. That broader behavior materially changes the trust boundary from local media generation to external delivery using privileged credentials, increasing the risk of unintended disclosure or misuse if users only expect local synthesis.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill reads ~/.zshrc and ~/.bashrc to extract DASHSCOPE_API_KEY, which reaches beyond its immediate runtime inputs and harvests credentials from unrelated shell initialization files. That behavior silently broadens the skill's access to local secrets and is especially risky because the skill also sends data to external services.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill loads Feishu credentials and configuration from external application files under ~/.openclaw, discovering bot secrets and messaging configuration without explicit user confirmation at execution time. This is dangerous because it allows the skill to inherit and use unrelated application credentials to transmit content externally.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The skill states that every output must be converted to speech and sent out, but it does not prominently disclose the privacy implications of transmitting user content to external providers such as DashScope and Feishu. This can cause sensitive prompts, generated content, or identifiers to leave the local environment without informed consent or data-minimization controls.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file includes a voice-cloning API example that demonstrates how to replicate a real person's voice without any nearby warning about consent, impersonation, privacy, or applicable legal restrictions. In a TTS skill whose purpose is to convert and send spoken output, this omission can normalize unsafe use and make misuse for social engineering, fraud, or unauthorized biometric replication more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script transmits user-provided text to a third-party TTS service over the network without any explicit warning, consent gate, or data-classification check. In an agent context, the text may contain sensitive model outputs, user data, credentials, or internal content, so automatic exfiltration to an external provider creates a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code reads sensitive secrets from local files and environment variables with no user-facing disclosure that credentials will be accessed and used. In an agent skill context, silent secret use is risky because the user may believe the action is limited to speech synthesis while the skill also authenticates to external messaging APIs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: User-provided text is transmitted to DashScope for TTS generation and then to Feishu as audio without any explicit warning, consent checkpoint, or content classification. In this skill's context, that is particularly sensitive because the description says it should be used before every output result, creating a broad and potentially automatic exfiltration path for model responses, secrets, or private user content.

External Transmission

Medium

• Category: Data Exfiltration

Content

TMP_OGG="/tmp/qwen_tts_$$.ogg"

# 调用千问 API
RESPONSE=$(curl -s -X POST 'https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation' \
    -H "Authorization: Bearer $API_KEY" \
    -H 'Content-Type: application/json' \
    -d "$(jq -n --arg text "$TEXT" --arg voice "$VOICE" --arg lang "$LANG" '{

• Confidence: 97% confidence
• Finding: This code performs external transmission of input text to Alibaba DashScope, which is significant because the skill description says output should always be converted to speech before being delivered. In practice, that means potentially every model response could be automatically sent to a third party, amplifying the privacy and data-leak risk in this skill context.

Unvalidated Output Injection

High

• Category: Output Handling

Content

ogg_path = tempfile.mktemp(suffix=".ogg")
    
    # 调用 Edge TTS，移除了 --timeout 参数避免 Node.js 内部报错
    result = subprocess.run(
        ["npx", "node-edge-tts", 
         "-t", text, 
         "-f", mp3_path,

• Confidence: 83% confidence
• Finding: Untrusted text is passed directly to a third-party Node TTS CLI. Even without shell=True, downstream tools may interpret argument values unexpectedly, mishandle very large inputs, or expose parser bugs, and this skill is designed to process arbitrary generated text automatically before sending it out.

Unvalidated Output Injection

High

• Category: Output Handling

Content

f.write(f"file '{wav_path}'\n")
        f.write(f"file '{silence_path}'\n")
    
    subprocess.run([
        "ffmpeg", "-f", "concat", "-safe", "0", "-i", concat_list,
        "-c:a", "libopus", "-b:a", "64k", "-ar", "48000",
        ogg_path, "-y"

• Confidence: 72% confidence
• Finding: The concat processing step feeds ffmpeg a manifest file containing paths assembled from temporary filenames and runs with -safe 0, reducing ffmpeg's path safety checks. Combined with insecure temporary path creation, this can let a local attacker influence what files are concatenated and converted.

Credential Access

High

• Category: Privilege Escalation

Content

session.trust_env = False

# ====== 飞书 Bot 配置（从文件读取）======
CREDS_FILE = os.path.expanduser("~/.openclaw/credentials/lark.secrets.json")
CONFIG_FILE = os.path.expanduser("~/.openclaw/openclaw.json")

def get_feishu_config():

• Confidence: 93% confidence
• Finding: The skill accesses a secrets file containing Feishu credentials and then uses those credentials to obtain a tenant token and send messages. In an agent skill, credential access tied to external transmission is highly sensitive because it enables authenticated actions on behalf of the user or application without granular consent.

Static analysis

No suspicious patterns detected.