Cyber Horn

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:20 PM UTC
• Version: 1.0.3

Overview

The skill is coherent and purpose-aligned, but it sends text/audio through external TTS and Feishu services using configured credentials.

Install only if you intend the agent to post voice messages to Feishu. Configure a least-privilege Feishu app, be careful with FEISHU_DEFAULT_CHAT_ID, and do not send secrets, personal data, or regulated content unless your use of Edge TTS or ElevenLabs and Feishu is approved. Review and update dependency pins before production deployment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says the skill turns text into spoken Feishu voice messages. However, the code only obtains a Feishu tenant access token and posts an IM message with msg_type set to "text". There is no TTS, no audio encoding, no voice upload, and no message type corresponding to audio/voice. The module docstring explicitly says it only tests Feishu authentication and sending a text message, and does not rely on TTS-related components. This is a clear description-behavior mismatch.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

CyberHorn (赛博小喇叭) 入口。
支持 CLI: python main.py "测试语音内容" "YOUR_CHAT_ID"
OpenClaw 可通过环境变量 + 命令行参数调用。
TTS 引擎可通过 .env 中的 TTS_PROVIDER 配置，默认 EDGE，可选 ELEVEN。
"""
import sys
from pathlib import Path

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Known Vulnerable Dependency: aiohttp==3.13.3 — 16 advisory(ies): CVE-2026-54279 (aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar Persistence); CVE-2026-34514 (AIOHTTP has CRLF injection through multipart part content type header constructi); CVE-2026-34517 (AIOHTTP has late size enforcement for non-file multipart fields causes memory Do) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The dependency pin `aiohttp==3.13.3` is flagged with multiple published advisories, including issues affecting cookie handling, CRLF injection, and multipart parsing/resource exhaustion. Because this skill likely performs network I/O to external APIs and messaging platforms, a vulnerable HTTP stack increases exposure to server-side request handling flaws, header injection, and denial-of-service conditions.

Known Vulnerable Dependency: idna==3.11 — 2 advisory(ies): CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA): Specially crafted inputs ); CVE-2026-45409 (Internationalized Domain Names in Applications (IDNA) for Python provides suppor)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: `idna==3.11` is reported with advisories involving specially crafted internationalized domain name inputs. In a skill that may contact external services over HTTP, incorrect IDNA handling can enable hostname confusion or validation bypass in edge cases involving attacker-controlled domains.

Known Vulnerable Dependency: urllib3==2.6.3 — 4 advisory(ies): CVE-2026-44432 (urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API); CVE-2026-44431 (urllib3: Sensitive headers forwarded across origins in proxied low-level redirec); CVE-2026-44431 (urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-o) +1 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: `urllib3==2.6.3` is flagged with advisories covering decompression-bomb protection bypass and forwarding of sensitive headers across origins in certain redirect/proxy flows. Since this skill is designed to interact with external services, flaws in the core HTTP client layer can affect confidentiality of tokens/headers and availability if malicious responses trigger excessive resource consumption.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README documents sending user-provided text to external network services (Edge TTS or ElevenLabs) and then to Feishu, but it does not clearly disclose that message contents leave the local environment and may be processed by third parties. In a skill context, users or calling agents may pass sensitive operational text, credentials, alerts, or internal data, so missing disclosure increases the risk of unintended data exfiltration and privacy/compliance violations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares capabilities that use environment secrets, network access, and shell execution but does not declare any explicit tool scope or permissions boundary. This is dangerous because an agent or reviewer cannot easily tell that invoking the skill may access Feishu credentials, call external services, and execute ffmpeg, increasing the risk of unintended secret use or unsafe execution paths.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger guidance uses broad natural-language phrases like 'say something in Feishu' and 'send a voice message to the group,' which could be matched during ordinary conversation. In an agent setting, this can cause unintended activation of a skill that sends external messages using configured credentials, potentially posting content to real chats without sufficiently explicit user consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explains setup and sending behavior but does not prominently warn that user text is converted to audio, uploaded to Feishu, and sent via configured credentials, possibly to a default chat ID. This is dangerous because users may not realize sensitive text will leave the local environment and be delivered to a potentially preconfigured recipient.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file’s natural-language content, including the module docstring and printed status/error messages, is entirely in Chinese. There is no indication that the skill is region-specific or that users can opt into this locale, which matches the policy concern about forcing a specific language without user choice.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-ar", "16000",
        str(opus_path),
    ]
    result = subprocess.run(
        cmd,
        capture_output=True,
        text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

External Transmission

Medium

• Category: Data Exfiltration

Content

def get_tenant_access_token(app_id: str, app_secret: str) -> str:
    """获取 tenant_access_token。失败时抛出并打印 API 错误信息。"""
    resp = requests.post(
        AUTH_URL,
        json={"app_id": app_id, "app_secret": app_secret},
        timeout=10,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tainted flow: 'headers' from requests.post (line 90, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

files = {"file": (name, file_content, "audio/opus")}

    headers = {"Authorization": f"Bearer {token}"}
    resp = requests.post(
        FILE_UPLOAD_URL,
        headers=headers,
        data=data,

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

External Transmission

Medium

• Category: Data Exfiltration

Content

params = {"receive_id_type": receive_id_type}
    payload = {"receive_id": receive_id, "msg_type": "audio", "content": content}

    resp = requests.post(
        MESSAGE_CREATE_URL,
        params=params,
        headers=headers,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Tainted flow: 'headers' from requests.post (line 90, network input) → requests.post (network output)

Medium

• Category: Data Flow

Content

params = {"receive_id_type": receive_id_type}
    payload = {"receive_id": receive_id, "msg_type": "audio", "content": content}

    resp = requests.post(
        MESSAGE_CREATE_URL,
        params=params,
        headers=headers,

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Known Vulnerable Dependency: requests==2.32.5 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: `requests==2.32.5` is associated with a vulnerability in `extract_zipped_paths()`, which can lead to insecure temporary file reuse. While that specific utility may not be used directly by this skill, keeping a version with a known published flaw still represents unnecessary attack surface and can become exploitable if future code paths or dependencies invoke the affected behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The natural-language strings in the docstring, argument descriptions, and status messages are entirely Chinese, with no indication that users may select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Static analysis

No suspicious patterns detected.