Feishu Voice Send

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:57 AM UTC
• Version: 1.0.3

Overview

The skill appears intended to generate Feishu-compatible voice audio, but its documentation overstates sending/receiving capabilities and under-discloses third-party text/audio processing risks.

Install only after reviewing the provider and dependency trust model. Treat any text or audio processed by this skill as potentially sent to MiniMax, Edge TTS, or related tooling, avoid secrets or regulated data, and verify whether you need a generator only or actual Feishu send/receive support.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Dependencies Enable Supply-Chain Substitution

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: send_feishu_voice.py:43

Finding

Race-Prone Temporary Files Permit Local File Replacement or Overwrite

Content

View full analysis

str: """Generate MP3 using MiniMax TTS. Returns file path.""" tmp = tempfile.mktemp(suffix='.mp3') result = subprocess.run( ['mmx', 'speech', 'synthesize', '--text', text, '--out', tmp], capture_output=True, text=True, timeout=30 ) if result.returncode != 0: raise RuntimeError(f"MiniMax TTS failed: {result.stderr}") if not os.path.exists(tmp): raise RuntimeError(f"MiniMax TTS output not found: {tmp}") return tmp ``` ```python def convert_mp3_to_ogg(mp3_path: str, output_path: str = None) -> str: """Convert MP3 to Feishu-native Ogg/Opus format using PyAV.""" if output_path is None: output_path = tempfile.mktemp(suffix='.ogg') out = av.open(output_path, 'w', format='ogg') ``` ### Technical Analysis `tempfile.mktemp()` returns an unused pathname but does not atomically create and securely reserve the corresponding file. A time-of-check/time-of-use window therefore exists between pathname generation and the later operation that opens the path. For the MP3 path, the external `mmx` process opens the generated name after it is returned by `mktemp()`. For the Ogg path, PyAV opens the generated name after the same insecure name-generation operation. A competing local process capable of discovering or predicting the pathname may create a file or symbolic link at that location before it is opened. The practical exploitability depends on local access, temporary-directory permissions, operating-system symbolic-link protections, pathname predictability, and the overwrite behavior of `mmx` and PyAV. Nevertheless, the API is explicitly unsuitable for secure temporary-file creation because it cannot eliminate this ra ...[truncated 1731 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims a broader skill: native Feishu voice messaging with both TTS and STT/Whisper receiving, plus multilingual support. This code chunk is narrower. It synthesizes speech with MiniMax or Edge TTS, converts MP3 to Ogg/Opus using PyAV, and returns or copies the resulting file. There is no code for receiving audio, transcribing with Whisper, or interacting with Feishu APIs to send a message. While 'no ffmpeg needed' is consistent with the PyAV-based conversion, the main declared capability set is only partially represented, so the description does not accurately match this supplied code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly describes converting user text and voice through external services such as MiniMax, Edge TTS, and Whisper, but does not warn users that message content and audio may leave the local environment and be processed by third parties. This creates a real privacy and consent risk, especially in enterprise chat contexts where voice messages may contain sensitive business or personal information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents code that invokes shell commands (mmx, node) and writes temporary audio files, but it declares no explicit tool scope or permissions boundary. In an agent environment, undeclared shell and file-write capability increases the chance of overbroad execution, unsafe composition with other tools, and user surprise about what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill processes user text for TTS and claims voice/STT support, but it does not warn that content may be sent to external providers such as MiniMax, Microsoft Edge TTS, or Whisper-related services/models. Missing disclosure can lead to inadvertent transmission of sensitive business or personal data to third parties, which is especially risky in enterprise chat contexts like Feishu.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and usage text describe a skill for sending native Feishu voice messages. In practice, the code selects a TTS backend, converts the result to OGG/Opus, and prints or copies the output path; there is no Feishu API call, message-posting logic, or any send action in the implementation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code sets DEFAULT_VOICE to Chinese (Mandarin)_Gentleman, which forces a specific language/locale choice for generated speech. The file does not offer the user any language or locale selection or document that this is a region-specific tool, so it conflicts with the policy against imposing a language without opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · send_feishu_voice.py (reported line 24)May include surrounding context.

python

def check_minimax_quota() -> int:
    """Check MiniMax speech-hd weekly quota remaining. Returns remaining count, ≤0 means no quota."""
    try:
        result = subprocess.run(
            ['mmx', 'quota', 'show', '--output', 'json'],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · send_feishu_voice.py (reported line 45)May include surrounding context.

python

def generate_minimax_tts(text: str) -> str:
    """Generate MP3 using MiniMax TTS. Returns file path."""
    tmp = tempfile.mktemp(suffix='.mp3')
    result = subprocess.run(
        ['mmx', 'speech', 'synthesize', '--text', text, '--out', tmp],
        capture_output=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · send_feishu_voice.py (reported line 65)May include surrounding context.

python

if not text_clean:
        text_clean = "Voice message"

    result = subprocess.run(
        ['node', EDGE_TTS_SCRIPT, text_clean, '--voice', DEFAULT_VOICE],
        capture_output=True,
        text=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The docstring explicitly states 'Generate and send Feishu voice message,' which implies a side effect of delivering a message. The implementation only chooses a TTS engine, generates audio, converts it, and returns the local file path, with no sending behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description does not clearly warn that it may send voice messages on the user's behalf into Feishu, which can create consent, audit, and social-engineering risks. In a messaging environment, actions that post as the user should be explicitly disclosed so users understand the operational and reputational impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.