moss-tts-family-chatbot

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:16 PM UTC
• Version: 0.0.4

Overview

This audio skill mostly matches its stated purpose, but it needs review because it can upload sensitive voice data, clone voices, and send Feishu voice messages without strong consent or confirmation safeguards.

Review this skill before installing if your workspace may receive private voice messages or if Feishu credentials are available. Use it only where users understand that audio/text may be sent to MOSI and Feishu, and do not use the voice-cloning feature for third parties, celebrities, coworkers, or customers without explicit authorization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description covers multiple major capabilities and behavioral requirements: automatic transcription of incoming audio, generic TTS, voice cloning, multi-speaker synthesis, and Feishu voice bubble support. This code chunk only implements one narrow subset: multi-speaker dialogue speech synthesis using a specific TTS model and voice IDs. It does not inspect messages, detect audio attachments, transcribe speech, clone voices, or integrate with Feishu. Because the code's actual scope is materially narrower than the declared purpose and misses several prominently claimed capabilities and trigger behaviors, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The description presents a broad voice-processing skill centered on speech recognition and speech synthesis use cases, including automatic transcription of inbound audio and user-invoked TTS/voice cloning features. The actual code does none of that: it accepts a textual prompt, calls the /audio/sound-effect endpoint with model moss-sound-effect, and writes the returned audio to a WAV file. That is a distinct primary purpose—sound effect generation rather than ASR/TTS or voice cloning. The code also does not inspect messages, handle inbound media/audio paths, produce Feishu voice bubbles, or implement any of the stated trigger logic. This is not just a partial implementation detail; the implemented capability is materially different and undeclared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk is narrowly focused on TTS: it accepts text, optional voice/config parameters, calls the /api/v1/audio/speech endpoint, and saves synthesized audio to a file. There is no code for speech recognition, parsing inbound media, handling the declared trigger conditions, cloning voices, generating multi-speaker dialogue, or integrating with Feishu voice bubbles. While TTS is accurately represented as one capability, the overall declared description materially overstates what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description claims a broad audio skillset with both recognition and multiple synthesis-related features, plus trigger-specific behavior requiring immediate transcription of attached audio. The provided code chunk implements only a narrow TTS capability. It does not inspect messages, detect audio attachments, transcribe speech, clone voices, synthesize multi-speaker dialogue, or integrate with Feishu voice bubbles. While TTS is part of the declared description, the overall declared purpose materially overstates what this code actually does, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The description claims a broad audio assistant with automatic speech recognition for incoming audio, text-to-speech generation, multi-speaker synthesis, voice cloning, and Feishu voice bubble support. The supplied code only implements a CLI wrapper around MOSI voice-cloning endpoints: file upload, clone creation, listing voices, and retrieving voice metadata. Although voice cloning is genuinely supported, the other major declared capabilities are absent. The code also contains no trigger-processing logic for detecting inbound media markers or user requests. Its primary purpose is voice clone asset management, not a comprehensive audio skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents a broad multimodal audio skill with mandatory transcription behavior for incoming voice messages and several advanced generation features. The actual code chunk is narrowly scoped to generating speech audio from text and a style instruction using an external API. There is no code for detecting the declared trigger conditions, reading audio inputs, performing speech recognition, cloning a specific speaker's voice, producing multi-speaker conversations, or integrating with Feishu voice bubble workflows. While TTS/voice synthesis is consistent with part of the declaration, the overall declared purpose materially overstates the implemented functionality.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/mosi_asr.sh (reported line 65)May include surrounding context.

sh

)
[ -n "$LANGUAGE" ] && CURL_ARGS+=(-F "language=${LANGUAGE}")

RESPONSE=$(curl "${CURL_ARGS[@]}")

if [ "$JSON_OUT" = "1" ]; then
  echo "$RESPONSE"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/mosi_dialogue.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# MOSI Multi-Speaker Dialogue (moss-ttsd) via curl + node
# Endpoint: POST /api/v1/audio/speech (same as TTS)
# Text format: [S1] line\n[S2] line\n[S1] ...
# Supports up to 5 speakers: voice_id / voice_id2 / voice_id3 / voice_id4 / voice_id5

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/mosi_feishu_voice.sh (reported line 76)May include surrounding context.

sh

# --- Step 4: Get Feishu token ---
echo "[4/5] Getting Feishu token..."
TOKEN=$(curl -sf -X POST \
  "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}" \

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/mosi_feishu_voice.sh (reported line 95)May include surrounding context.

sh

# --- Step 5: Upload OPUS + send voice bubble ---
echo "[5/5] Uploading and sending voice bubble..."
FILE_KEY=$(curl -sf -X POST \
  "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer ${TOKEN}" \
  -F "file_type=opus" \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/mosi_sound_effect.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# MOSI Sound Effect Generation via curl + node
set -e

usage() {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of shell, network access, environment secrets, and file writes, but it does not declare any tool scope or allowed-tools boundary. This increases the chance an agent will execute broader capabilities than intended, including external requests and handling sensitive credentials, without policy-level restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill supports uploading user audio for voice cloning and creating reusable custom voices, but it does not require an explicit consent and privacy warning. Voice samples are highly sensitive biometric data, and cloning another person's voice without documented authorization creates serious privacy, impersonation, and abuse risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill includes a secondary capability to obtain Feishu tokens and send audio messages using separate credentials, which extends beyond local audio generation/transcription into external message delivery. That expands the trust boundary and can cause unintended exfiltration or impersonation-style actions if invoked without clear user authorization and scoped permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Feishu voice-bubble workflow transmits generated audio to an external platform using app credentials, but the documentation does not require a user warning or explicit approval for that external transmission. This can surprise users and leak sensitive spoken content to third-party systems or unintended chat recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document exposes voice-cloning and audio-upload capabilities without any consent, authorization, or privacy guidance. In the context of a skill explicitly designed to clone voices and process user audio, this omission can enable impersonation, unauthorized biometric processing, and misuse of third-party voice samples, making the feature materially riskier rather than merely incomplete documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script uploads user-provided audio files to a third-party service at studio.mosi.cn for transcription, but there is no built-in consent prompt, warning, or privacy gating before transmitting potentially sensitive voice content. In this skill's context, automatic triggering on inbound voice messages makes the risk more acute because users may not realize their recordings are being sent off-platform to an external processor.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mosi_dialogue.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# MOSI Multi-Speaker Dialogue (moss-ttsd) via curl + node
# Endpoint: POST /api/v1/audio/speech (same as TTS)
# Text format: [S1] line\n[S2] line\n[S1] ...
# Supports up to 5 speakers: voice_id / voice_id2 / voice_id3 / voice_id4 / voice_id5

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mosi_dialogue.sh (reported line 90)May include surrounding context.

sh

echo "Generating dialogue..."

curl -sf -X POST \
  "https://studio.mosi.cn/api/v1/audio/speech" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mosi_feishu_voice.sh (reported line 76)May include surrounding context.

sh

# --- Step 4: Get Feishu token ---
echo "[4/5] Getting Feishu token..."
TOKEN=$(curl -sf -X POST \
  "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"${FEISHU_APP_ID}\",\"app_secret\":\"${FEISHU_APP_SECRET}\"}" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sends FEISHU_APP_ID and FEISHU_APP_SECRET to Feishu to obtain an access token, but there is no explicit user-facing disclosure that these credentials will be used in a network request. While the script logs progress steps, it does not warn about handling or transmitting sensitive authentication material.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mosi_feishu_voice.sh (reported line 116)May include surrounding context.

sh

});
")

curl -sf -X POST \
  "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mosi_sound_effect.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# MOSI Sound Effect Generation via curl + node
set -e

usage() {

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes ASR, TTS, multi-speaker dialogue synthesis, voice cloning, and Feishu voice bubbles, all centered on speech/voice functions. This script instead calls a dedicated sound-effect generation endpoint using model 'moss-sound-effect', which is a distinct audio-generation capability not mentioned in the declared skill purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This line performs an outbound POST to a third-party API and includes the full prompt in the request body plus an authorization token in headers. External transmission is expected for this feature, but it still creates a real data-exposure boundary: any sensitive user text in the prompt leaves the local environment and is processed by an outside service.

Content

Scanner excerpt · scripts/mosi_sound_effect.sh (reported line 57)May include surrounding context.

sh

echo "Generating sound effect: ${PROMPT:0:60}..."

curl -sf -X POST \
  "https://studio.mosi.cn/api/v1/audio/sound-effect" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.