Security audit

feishu-audio-messages

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Feishu voice-message helper, but users should treat message text, audio, recipient IDs, and Feishu app credentials as sensitive because they are used with external services.

Install only if you trust the Feishu app credentials and are comfortable sending the chosen text/audio and recipient open_id to Feishu, and text to the configured TTS provider. Prefer environment variables or tightly permissioned config files for credentials, use a virtual environment with a pinned edge-tts version, and avoid using this on shared hosts unless the temporary-file handling is improved.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:65
Finding: Unpinned Third-Party TTS Dependency
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:65-68
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

bash
pip install edge-tts

The installed executable is subsequently invoked by send-voice.sh:245-250:

bash
edge-tts \ --voice "$VOICE" \ --rate "$RATE" \ --volume "$VOLUME" \ --text "$TEXT" \ --write-media "$MP3_FILE" || error "TTS generation failed"

Technical Analysis

The installation documentation instructs users to install edge-tts without specifying a reviewed version or verifying package integrity. Package resolution can therefore select a future, compromised, or otherwise unexpected release.

Because the resulting edge-tts executable is invoked directly by the Skill, arbitrary code included in the resolved package would execute with the privileges of the user running the installation or script. The project does not provide a lock file, package hash, or other mechanism to ensure that the installed artifact is the version reviewed by the Skill author.

Attack Path

An attacker compromises the upstream package, publishing infrastructure, or a future package release.

A user follows the documented pip install edge-tts instruction.

Package installation hooks or malicious runtime code execute under the user's account.

The Skill later invokes the installed edge-tts executable.

Malicious code can access data and resources available to the process, including input text, local files, and credentials readable by the user.

Impact Assessment

Successful exploitation can result in arbitrary code execution with the installing or invoking user's privileges. This may expose Feishu credentials, synthesized text, local audio, and other files accessible to that user. It could also permit modification of user-owned files or further network activity.

The Skill itself does not retrieve or execute a remote script di ...[truncated 72 chars]
Remediation: View remediation
Remediation Suggestions

Pin edge-tts to a specific reviewed version instead of resolving the latest available release.

Supply a locked requirements file containing cryptographic hashes and install it with pip install --require-hashes.

Install the dependency in a dedicated virtual environment under an unprivileged account.

Periodically review and deliberately update the pinned version after checking release provenance and security advisories.

Document the exact supported version and avoid recommending privileged or system-wide package installation.

T09 · Insecure Skill Coding Practices

Note

Location: send-voice.sh:22
Finding: Predictable and Insufficiently Protected Temporary Directory
Content: View full analysis
Vulnerability Details

File Location: send-voice.sh:22-24, with temporary-file writes at send-voice.sh:241 and send-voice.sh:273
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Low

bash
TEMP_DIR="/tmp/feishu-voice-$$" mkdir -p "$TEMP_DIR"

The predictable directory is subsequently used for generated and converted audio:

bash
MP3_FILE="$TEMP_DIR/speech.mp3"

bash
OPUS_FILE="$TEMP_DIR/audio.opus"

Technical Analysis

The directory name is based only on the process ID and is therefore predictable. mkdir -p does not provide exclusive creation and succeeds if the path already exists. The script also does not establish a restrictive umask or explicitly set directory permissions.

On a multi-user system, another local user may predict or observe the process ID and pre-create or monitor the corresponding path. Depending on filesystem protections and the invoking user's umask, generated speech and converted audio may be exposed. Pre-creation can also interfere with file output, cause denial of service, or create opportunities to manipulate the content uploaded to Feishu.

Although shell variables are quoted and the script removes its temporary directory on exit, those controls do not address predictable naming or exclusive secure creation.

Attack Path

A local attacker predicts or observes the PID of an upcoming script process.

The attacker pre-creates /tmp/feishu-voice-<PID> or monitors the directory after creation.

The script accepts the existing path because it uses mkdir -p.

The script writes speech.mp3 and audio.opus into that location.

Subject to local permissions and filesystem behavior, the attacker reads the audio, modifies it before upload, or prevents successful file creation and conversion.

Impact Assessment

The likely scope is limited to a local attacker on the same host. Potential impact includes discl ...[truncated 299 chars]
Remediation: View remediation
Remediation Suggestions

Replace predictable directory construction with atomic, exclusive creation and enforce private permissions:

bash
umask 077 TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/feishu-voice.XXXXXX") \ || error "Unable to create a secure temporary directory" trap cleanup EXIT

Additionally:

Confirm that TEMP_DIR is a directory owned by the current user before using it.

Preserve quoting around all temporary paths.

Keep the existing exit cleanup trap.

Consider refusing symbolic links and validating temporary output files before uploading them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The documentation instructs the skill to read app credentials from common local files such as ~/.openclaw/.env and ~/.openclaw/openclaw.json, which is legitimate, but it does not pair that with safeguards for secret storage. In context, this increases the chance that sensitive Feishu credentials are left in plaintext, overexposed via permissive filesystem permissions, backups, logs, or accidental repository commits.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

配置文件：~/.openclaw/.env

配置文件：~/.openclaw/openclaw.json

.env 格式

text
FEISHU_APP_ID=cli_xxxxxxxx

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 178)May include surrounding context.
sh
return 0 fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 184)May include surrounding context.
sh
return 0 fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 205)May include surrounding context.
sh
return 0 fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 179)May include surrounding context.
sh
fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 180)May include surrounding context.
sh
fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 181)May include surrounding context.
sh
fi # 从 .env 文件获取 if [[ -f "$HOME/.openclaw/.env" ]]; then APP_ID=$(grep "^FEISHU_APP_ID=" "$HOME/.openclaw/.env" | cut -d'=' -f2) APP_SECRET=$(grep "^FEISHU_APP_SECRET=" "$HOME/.openclaw/.env" | cut -d'=' -f2)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · send-voice.sh (reported line 208)May include surrounding context.
sh
error "找不到飞书凭据。请设置 FEISHU_APP_ID 和 FEISHU_APP_SECRET 环境变量，或在 ~/.openclaw/.env 或 ~/.openclaw/openclaw.json 中配置" } # 获取 access token get_access_token() { echo "获取 access_token..." >&2

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description explains how to send voice messages via Feishu and use Edge TTS, but it does not clearly warn that recipient identifiers, message text, and uploaded audio content will be transmitted to third-party services during processing and delivery. In a messaging/TTS skill, that omission can cause users to unknowingly send sensitive data off-host, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
pip install edge-tts # ffmpeg (Ubuntu/Debian) sudo apt-get install ffmpeg # ffmpeg (macOS with Homebrew) brew install ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · send-voice.sh (reported line 262)May include surrounding context.
sh
pip install edge-tts # ffmpeg (Ubuntu/Debian) sudo apt-get install ffmpeg # ffmpeg (macOS with Homebrew) brew install ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
brew install ffmpeg

jq (可选，用于更可靠的JSON解析)

sudo apt-get install jq # or brew install jq

text
## 配置说明

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The credential configuration section tells users where to place Feishu app credentials, but it omits basic secret-handling guidance such as restricting file permissions, avoiding source control, and rotating leaked credentials. Because these values enable API access, poor handling increases the chance of credential disclosure and unauthorized message sending.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This shell script reads Feishu application credentials from environment variables and local configuration files, which is a sensitive operation under the warning criteria for code files. Although the code contains internal status messages, it does not provide a clear user-facing warning in comments or usage text that the script will access FEISHU_APP_ID/FEISHU_APP_SECRET or read credential files from ~/.openclaw.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script transmits sensitive user-supplied data off-host: app credentials to Feishu for token issuance, text to edge-tts for speech synthesis, audio to Feishu for upload, and recipient open_id to Feishu for message delivery. The help text describes functionality but does not explicitly disclose these network transmissions, which can cause users to unknowingly send private content or identifiers to third parties.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · send-voice.sh (reported line 212)May include surrounding context.
sh
get_access_token() { echo "获取 access_token..." >&2 TOKEN_RESPONSE=$(curl -s -X POST \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · send-voice.sh (reported line 313)May include surrounding context.
sh
send_message() { echo "发送消息..." >&2 MESSAGE_RESPONSE=$(curl -s -X POST \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d "{

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The script hard-codes zh-CN-XiaoxiaoNeural as the default voice, which imposes a specific language/locale choice unless the user overrides it manually. Under the language/locale policy rule, forcing a locale without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Impact Assessment

Remediation Suggestions

SkillSpector

Credential Access

.env 格式

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

jq (可选，用于更可靠的JSON解析)

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

Natural-Language Policy Violations

Static analysis