ClawHub
Back to skill

Security audit

Feishu Voice Loop

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: converts text or local audio into speech and sends it through OpenAI and Feishu, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending message text, generated audio, Feishu recipient IDs, and Feishu app authentication material to the intended OpenAI and Feishu services. Review the Feishu app permissions and your ~/.openclaw/openclaw.json transcription command before using it with sensitive audio or business content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 34)May include surrounding context.

python
headers={**(headers or {}), 'Content-Type': 'application/json'},
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.read(), dict(r.headers)
    except urllib.error.HTTPError as e:
        body = e.read().decode(errors='replace')

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 59)May include surrounding context.

python
headers={**(headers or {}), 'Content-Type': 'application/json'},
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.read(), dict(r.headers)
    except urllib.error.HTTPError as e:
        body = e.read().decode(errors='replace')

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 122)May include surrounding context.

python
},
        )
        try:
            with urllib.request.urlopen(req, timeout=120) as r:
                wav_path.write_bytes(r.read())
        except urllib.error.HTTPError as e:
            body = e.read().decode(errors='replace')

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs users to send text, voice-derived transcripts, synthesized audio, and Feishu recipient identifiers to third-party services, but it does not clearly warn that this data leaves the local environment and is transmitted to OpenAI and Feishu. This creates a real privacy and compliance risk because users may unknowingly process sensitive content or personal identifiers through external providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow explicitly sends generated speech to Feishu and uses OpenAI TTS, which implies user content is transmitted to third-party services, but the documentation gives no warning, consent expectation, or data-handling guidance. In a voice workflow, message text may contain sensitive personal or business data, so failing to surface this data egress creates a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The voice-input section instructs users to transcribe local audio using a configured Whisper-style model but does not clarify whether the model/tooling is fully local or could invoke external services or process sensitive recordings. Because audio often contains PII, confidential discussions, or credentials spoken aloud, omitting privacy warnings and trust-boundary details is a meaningful security and compliance issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This markdown file repeatedly instructs the skill to "Speak in Chinese," and the file states the default preset should be used unless the user asks otherwise. That creates a language/locale constraint by default rather than presenting it as an explicit user choice, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The softer/younger, teasing, and mature/cooler presets all specify Chinese delivery as part of the preset text. Because these are presented as reusable preset instructions without any accompanying language-choice mechanism or justification, they reinforce a forced language policy issue across the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends user-supplied text to OpenAI for speech generation and then sends the resulting audio to Feishu, but it provides no user-facing disclosure, consent prompt, or warning about third-party transmission. In an agent skill context, this can cause users to unknowingly expose sensitive or regulated content to external services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 108)May include surrounding context.

python
try:
        req = urllib.request.Request(
            'https://api.openai.com/v1/audio/speech',
            data=json.dumps({
                'model': args.model,
                'voice': args.voice,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 128)May include surrounding context.

python
body = e.read().decode(errors='replace')
            fail(f'HTTP {e.code} calling OpenAI audio/speech\n{body}', 12)

        subprocess.run([
            '/opt/homebrew/bin/ffmpeg', '-y', '-i', str(wav_path),
            '-ac', '1', '-ar', '16000', '-c:a', 'libopus', '-b:a', '24k', str(ogg_path)
        ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/openai_tts_feishu.py (reported line 133)May include surrounding context.

python
'-ac', '1', '-ar', '16000', '-c:a', 'libopus', '-b:a', '24k', str(ogg_path)
        ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

        duration_sec = subprocess.check_output([
            'ffprobe', '-v', 'quiet', '-show_entries', 'format=duration', '-of', 'csv=p=0', str(ogg_path)
        ], text=True).strip()
        duration_ms = round(float(duration_sec) * 1000)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe_audio.py (reported line 46)May include surrounding context.

python
for token in model.get('args', []):
            rendered.append(token.replace('{{OutputDir}}', outdir).replace('{{MediaPath}}', str(media_path)))
        cmd.extend(rendered)
        subprocess.run(cmd, check=True)
        txt_path = Path(outdir) / f'{media_path.stem}.txt'
        if not txt_path.exists():
            candidates = list(Path(outdir).glob('*.txt'))

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script executes an external command from configuration via subprocess.run, but provides no visible confirmation prompt, log output, or warning that a local CLI will be launched. Although transcription is the stated purpose, the exact executable comes from user configuration and the file contains no disclosure of that execution step beyond the argparse description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The usage example shows synthesized output only in Chinese, which can imply a fixed language expectation in the skill's documented behavior. There is no accompanying note that language is user-selectable or that the workflow is intentionally region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code reads ~/.openclaw/openclaw.json, which may contain local tool configuration and potentially sensitive command details, but there is no prompt, log message, comment, or other user disclosure indicating that the script will access that file. For code files, accessing potentially sensitive local configuration can merit a warning when no disclosure is present.

Content

No source excerpt is available for this finding.