ClawHub
Back to skill

Security audit

Feishu Voice Chat

Security checks for vulnerabilities and agentic risk

Overview

This voice skill is mostly purpose-aligned, but its ASR file handling and generated Feishu message commands create review-worthy risks before installation.

Review this before installing if the agent may process untrusted file paths or message IDs. It should restrict ASR input to the intended Feishu inbound media directory, resolve and reject symlinks, validate audio files, return structured message data instead of executable-looking command strings, and pin dependencies. Use a dedicated Volcengine token with minimal scope.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/volc_voice.py:37
Finding

Symlink Bypass Allows Unauthorized Local File Disclosure to an External ASR Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/feishu_voice.py:112
Finding

Unescaped Values Are Embedded in Agent Tool-Call Instructions

Content
View full analysis
3 else None reply_to = sys.argv[4] if len(sys.argv) > 4 else None result = synthesize_speech(text, output_path, reply_to) ``` ### Technical Analysis The wrapper constructs executable-looking `message(...)` instructions by directly interpolating `file_path` and `reply_to` into a string. Neither value is escaped for the generated instruction syntax. The `reply_to` value is directly caller-controlled. The output path is also caller-controlled and is eventually returned as `file_path` by the TTS subprocess. A value containing quotation marks, delimiters, or instruction-like content can break out of its intended quoted argument and alter the apparent tool call. The Python subprocess calls themselves use argument arrays and therefore are not shell-injection sinks. The vulnerability instead arises at the Agent integration boundary: the generated string is specifically documented as an instruction for an Agent to invoke the `message` tool. If an Agent or orchestration layer interprets that string as trusted executable guidance, crafted values can manipulate the resulting tool invocation. ### Attack Path 1. An attacker or untrusted caller supplies a crafted `reply_to` value or output filename containing quote characters and additional instruction syntax. 2. `synthesize_speech() ...[truncated 1231 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned Runtime Dependencies Create Non-Reproducible Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (24)

Tainted flow: 'query_headers' from os.getenv (line 293, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 306)May include surrounding context.

python
query_headers["X-Tt-Logid"] = x_tt_logid

        for i in range(120):
            query_response = requests.post(ASR_QUERY_URL, data=json.dumps({}), headers=query_headers)

            if 'X-Api-Status-Code' in query_response.headers:
                code = query_response.headers["X-Api-Status-Code"]

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The skill description presents a full Feishu voice interaction pipeline and a strict response policy, but the file only documents ASR/TTS helper scripts and relies on other components to receive and send messages. This mismatch can mislead operators and agents about what security boundaries, external data flows, and messaging actions are actually implemented, causing unsafe assumptions during deployment.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
## 前置准备

1.  **注册火山引擎账号**: 访问 [火山引擎语音服务控制台](https://console.volcengine.com/speech/app)。
2.  **创建应用**: 在控制台创建一个应用，获取 `AppID` 和 `Access Token`（**注意**：这是语音服务的凭证，不同于火山引擎 ARK API 的 Key）。
3.  **开通服务**: 为应用开通「**大模型语音合成 TTS**」和「**大模型录音文件识别 ASR**」两个服务。
4.  **安装依赖**: `pip install -r requirements.txt`

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
## 前置准备

1.  **注册火山引擎账号**: 访问 [火山引擎语音服务控制台](https://console.volcengine.com/speech/app)。
2.  **创建应用**: 在控制台创建一个应用，获取 `AppID` 和 `Access Token`（**注意**：这是语音服务的凭证，不同于火山引擎 ARK API 的 Key）。
3.  **开通服务**: 为应用开通「**大模型语音合成 TTS**」和「**大模型录音文件识别 ASR**」两个服务。
4.  **安装依赖**: `pip install -r requirements.txt`

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 18)May include surrounding context.

python
logger = logging.getLogger(__name__)

script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中
load_dotenv(skill_env_path, override=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中
load_dotenv(skill_env_path, override=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 20)May include surrounding context.

python
script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中
load_dotenv(skill_env_path, override=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 21)May include surrounding context.

python
script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中
load_dotenv(skill_env_path, override=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 66)May include surrounding context.

python
script_dir = os.path.dirname(os.path.abspath(__file__))
skill_env_path = os.path.join(script_dir, '..', '.env')

# 加载 Skill 本地 .env 配置 / Load skill local .env config
# TTS/ASR 凭证（VOLC_APPID + VOLC_ACCESS_TOKEN）配置在 skills/.env 中
load_dotenv(skill_env_path, override=True)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 67)May include surrounding context.

python
"""检查必要的环境变量配置 / Check required environment variables"""
    if not APPID or not ACCESS_TOKEN:
        logger.error("Error: 请在 skills/feishu-voice-chat/.env 中配置 VOLC_APPID 和 VOLC_ACCESS_TOKEN")
        logger.error("Error: Please configure VOLC_APPID and VOLC_ACCESS_TOKEN in skills/.env")
        sys.exit(1)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares capabilities that involve shell execution, network access, environment-variable use, and file writes, but it does not define any explicit tool scope or allowed-tools boundary. In an agent environment, this increases the chance that the skill can invoke more powerful operations than intended, making misuse or prompt-driven tool abuse easier.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description and behavior are specified entirely in Chinese and mandate a fixed response mode for voice interactions, without indicating that users can choose another language or locale. This can violate language/locale policy when the skill is used in broader contexts where user language preference is not guaranteed to be Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/feishu_voice.py (reported line 30)May include surrounding context.

python
print(f"🎙️ 正在识别语音: {audio_path}", flush=True)

    try:
        result = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "asr", audio_path],
            capture_output=True,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/feishu_voice.py (reported line 89)May include surrounding context.

python
print(f"🔊 正在合成语音: {text[:50]}...", flush=True)

    try:
        result = subprocess.run(
            [sys.executable, str(SCRIPT_PATH), "tts", text, output_path],
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is presented as a voice ASR/TTS wrapper, but it emits executable-looking message tool command strings that can trigger outbound Feishu sends or replies. Mixing content generation with action-invocation strings increases the chance that another agent component treats this output as trusted instructions, enabling unintended message actions or confused-deputy behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes a voice-processing skill that performs ASR and TTS for Feishu voice messages, but it does not mention local command execution or dependence on external system binaries. This code calls ffmpeg via subprocess to transform audio, introducing process-execution capability beyond the stated purpose and trust model.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/volc_voice.py (reported line 123)May include surrounding context.

python
'-f', 'ogg',
            output_path
        ]
        result = subprocess.run(cmd, capture_output=True, timeout=60)
        if result.returncode == 0 and os.path.exists(output_path):
            logger.info(f"转换成功: {output_path}")
            return True

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The TTS payload hard-codes "explicit_language":"zh", which imposes a specific language setting on generated speech. This is a natural-language policy concern because the skill does not offer the user a language choice or document this as a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency list includes requests without a version pin, making builds non-reproducible and allowing different environments to resolve to different releases. This is risky here because static analysis already indicates multiple known advisories for this package, so the skill could unknowingly install a vulnerable version.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests
python-dotenv

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest does not specify which requests version is installed, while the package has numerous known advisories, including credential leakage and TLS/verification-related issues. In a voice-chat skill that likely performs network requests to external APIs, a vulnerable requests release could expose secrets, mishandle transport security, or leak credentials during outbound communication.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

python-dotenv is also unpinned, which means dependency resolution may vary over time and across deployments. Because the package has known advisories and no version is specified, there is no assurance that installation will avoid affected releases.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests
python-dotenv

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
84% confidence
Finding

python-dotenv has known advisories, and because no version is pinned, the deployed version may be affected. The likely impact is lower than for active network libraries, but if the skill writes or manages .env files in tooling or deployment flows, a vulnerable release could contribute to configuration tampering or file overwrite issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The file’s user-facing descriptions and outputs are hardcoded in Chinese/English, indicating a fixed locale presentation rather than adapting to user preference. Under the policy rule, forcing a specific language or locale without explicit opt-in can be a natural-language policy concern even when multiple languages are included.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.