ClawHub
Back to skill

Security audit

飞书TTS Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims by converting text to audio and sending it as a Feishu voice message, with privacy and hardening cautions but no hidden or purpose-mismatched behavior found.

Install this only if you want text sent through Edge-TTS/Microsoft and Feishu as a voice message. Avoid using it for secrets or regulated personal data, use a least-privilege Feishu app and explicit recipient when possible, pin edge-tts in your environment, and avoid running it on shared machines unless temporary-file handling is improved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Unpinned Third-Party TTS Dependency

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
bin/tts-send.js:73
Finding

Predictable Audio Files Written to a Shared Temporary Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
bin/tts-send.js:157
Finding

Generated Audio Is Not Reliably Deleted After Failures

Content
View full analysis
{ if (code !== 0) return reject(new Error(`TTS 生成失败 (exit ${code})，请确认 edge-tts 已安装: pip install edge-tts`)); const ffmpeg = spawn('ffmpeg', [ '-i', mp3File, '-acodec', 'libopus', '-ar', '16000', '-ac', '1', '-y', oggFile, ]); ffmpeg.on('close', (code2) => { fs.unlink(mp3File, () => {}); if (code2 !== 0) return reject(new Error(`音频转换失败 (ffmpeg exit ${code2})`)); resolve(oggFile); }); ffmpeg.on('error', reject); }); py.on('error', (err) => reject(new Error(`Python 执行失败: ${err.message}`))); ``` ```js async function main() { try { console.log(`🎤 生成语音 (音色: ${VOICE}): ${text.substring(0, 20)}${text.length > 20 ? '...' : ''}`); const oggPath = await ttsToOgg(text); const duration = await getDuration(oggPath); console.log(`📤 上传音频 (${Math.round(duration)}ms)...`); const token = await getAccessToken(); const fileKey = await uploadAudioOgg(token, oggPath, duration); const msgId = await sendAudioMessage(token, fileKey); console.log(`✅ 语音气泡发送成功！消息ID: ${msgId}`); fs.unlink(oggPath, () => {}); } catch (err) { console.error(`❌ 失败: ${err.message}`); process.exit(1); } } ``` ### Technical Analysis Temporary-file deletion occurs only on selected control-flow paths: - The MP3 deletion is attempted after FFmpeg closes, but not when Python fails after creating partial output or when FFmpeg emits an `error` event before `close`. - The OGG deletion occurs only after the Feishu message is sent successfully. - If duration probing, token acquisition, upload, or message delivery fails, the OGG file remains. - Cleanup errors are ignored because the callbacks discard their error arguments. - There is no `finally` block that guarantees cleanup across success and failure paths. Genera ...[truncated 1097 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill explicitly requires environment secrets and performs networked actions, but it does not declare any tool scope or allowed-tools boundaries. This weakens policy enforcement and makes it easier for an agent runtime to grant broader-than-necessary access, especially for a skill that can transmit content and use credentials to contact external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger text is broad enough to match common requests like '用语音回复' or '朗读内容', which can cause the skill to activate in ordinary conversations without strong user intent to send data externally. In this skill's context, accidental activation is more dangerous because activation leads to outbound transmission of user-provided text and message delivery to a Feishu recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description does not clearly warn that input text will be sent to external services for TTS generation and then uploaded to Feishu, potentially exposing sensitive content to third parties. Because the skill is designed to transform arbitrary user text and send it over the network using configured credentials, missing disclosure materially increases privacy and data-leak risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The help text explicitly states the input must be Chinese text and the default voice is a zh-CN voice, presenting the skill as Chinese-only behavior. The file does not offer a language choice or indicate that this locale restriction is optional, which violates the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bin/tts-send.js (reported line 79)May include surrounding context.

js
// ============ 飞书 API ================
async function getAccessToken() {
  const resp = await fetch('https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ app_id: FEISHU_APP_ID, app_secret: FEISHU_APP_SECRET }),

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bin/tts-send.js (reported line 98)May include surrounding context.

js
form.append('file_type', 'opus');
  if (durationMs) form.append('duration', String(Math.round(durationMs)));

  const resp = await fetch('https://open.feishu.cn/open-apis/im/v1/files', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${token}` },
    body: form,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bin/tts-send.js (reported line 109)May include surrounding context.

js
}

async function sendAudioMessage(token, fileKey) {
  const resp = await fetch('https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${token}`,

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
bin/tts-send.js:129