Feishu Voice Loop

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:43 PM UTC
• Version: 1.0.0

Overview

This skill does what it says: converts text or local audio into speech and sends it through OpenAI and Feishu, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending message text, generated audio, Feishu recipient IDs, and Feishu app authentication material to the intended OpenAI and Feishu services. Review the Feishu app permissions and your ~/.openclaw/openclaw.json transcription command before using it with sensitive audio or business content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={**(headers or {}), 'Content-Type': 'application/json'},
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.read(), dict(r.headers)
    except urllib.error.HTTPError as e:
        body = e.read().decode(errors='replace')

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={**(headers or {}), 'Content-Type': 'application/json'},
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return r.read(), dict(r.headers)
    except urllib.error.HTTPError as e:
        body = e.read().decode(errors='replace')

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.getenv (line 107, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

},
        )
        try:
            with urllib.request.urlopen(req, timeout=120) as r:
                wav_path.write_bytes(r.read())
        except urllib.error.HTTPError as e:
            body = e.read().decode(errors='replace')

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs users to send text, voice-derived transcripts, synthesized audio, and Feishu recipient identifiers to third-party services, but it does not clearly warn that this data leaves the local environment and is transmitted to OpenAI and Feishu. This creates a real privacy and compliance risk because users may unknowingly process sensitive content or personal identifiers through external providers.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow explicitly sends generated speech to Feishu and uses OpenAI TTS, which implies user content is transmitted to third-party services, but the documentation gives no warning, consent expectation, or data-handling guidance. In a voice workflow, message text may contain sensitive personal or business data, so failing to surface this data egress creates a real privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The voice-input section instructs users to transcribe local audio using a configured Whisper-style model but does not clarify whether the model/tooling is fully local or could invoke external services or process sensitive recordings. Because audio often contains PII, confidential discussions, or credentials spoken aloud, omitting privacy warnings and trust-boundary details is a meaningful security and compliance issue.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This markdown file repeatedly instructs the skill to "Speak in Chinese," and the file states the default preset should be used unless the user asks otherwise. That creates a language/locale constraint by default rather than presenting it as an explicit user choice, which matches the policy-violation category for forced language behavior.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The softer/younger, teasing, and mature/cooler presets all specify Chinese delivery as part of the preset text. Because these are presented as reusable preset instructions without any accompanying language-choice mechanism or justification, they reinforce a forced language policy issue across the file.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script sends user-supplied text to OpenAI for speech generation and then sends the resulting audio to Feishu, but it provides no user-facing disclosure, consent prompt, or warning about third-party transmission. In an agent skill context, this can cause users to unknowingly expose sensitive or regulated content to external services.

External Transmission

Medium

• Category: Data Exfiltration

Content

try:
        req = urllib.request.Request(
            'https://api.openai.com/v1/audio/speech',
            data=json.dumps({
                'model': args.model,
                'voice': args.voice,

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

body = e.read().decode(errors='replace')
            fail(f'HTTP {e.code} calling OpenAI audio/speech\n{body}', 12)

        subprocess.run([
            '/opt/homebrew/bin/ffmpeg', '-y', '-i', str(wav_path),
            '-ac', '1', '-ar', '16000', '-c:a', 'libopus', '-b:a', '24k', str(ogg_path)
        ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-ac', '1', '-ar', '16000', '-c:a', 'libopus', '-b:a', '24k', str(ogg_path)
        ], check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

        duration_sec = subprocess.check_output([
            'ffprobe', '-v', 'quiet', '-show_entries', 'format=duration', '-of', 'csv=p=0', str(ogg_path)
        ], text=True).strip()
        duration_ms = round(float(duration_sec) * 1000)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for token in model.get('args', []):
            rendered.append(token.replace('{{OutputDir}}', outdir).replace('{{MediaPath}}', str(media_path)))
        cmd.extend(rendered)
        subprocess.run(cmd, check=True)
        txt_path = Path(outdir) / f'{media_path.stem}.txt'
        if not txt_path.exists():
            candidates = list(Path(outdir).glob('*.txt'))

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script executes an external command from configuration via subprocess.run, but provides no visible confirmation prompt, log output, or warning that a local CLI will be launched. Although transcription is the stated purpose, the exact executable comes from user configuration and the file contains no disclosure of that execution step beyond the argparse description.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The usage example shows synthesized output only in Chinese, which can imply a fixed language expectation in the skill's documented behavior. There is no accompanying note that language is user-selectable or that the workflow is intentionally region-specific.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This code reads ~/.openclaw/openclaw.json, which may contain local tool configuration and potentially sensitive command details, but there is no prompt, log message, comment, or other user disclosure indicating that the script will access that file. For code files, accessing potentially sensitive local configuration can merit a warning when no disclosure is present.

Static analysis

No suspicious patterns detected.