Minimax Feishu Voice

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but users should understand that message text is sent to MiniMax and the generated audio plus recipient ID are sent to Feishu.

Install this only if you are comfortable sending voice-message text to MiniMax for TTS processing and uploading the resulting audio and recipient open_id to Feishu. Avoid using it for secrets, regulated data, or sensitive personal information unless those providers and your Feishu app permissions are approved for that use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger list is broad enough to match common requests like "send voice message" or "replying with voice," which can cause the skill to activate in situations where the user did not explicitly intend Feishu delivery or external TTS processing. In this skill's context, that increases the chance of unintended transmission of message content and recipient identifiers to MiniMax and Feishu.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to send text through MiniMax TTS and then upload resulting audio to Feishu, but it does not clearly warn that user text and recipient identifiers will be transmitted to external services. In this context, the omission matters because the skill handles message contents and a Feishu open_id, creating privacy and consent risks if users assume processing is local.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal