Telegram语音消息技能包:基于实际踩坑经验的完整解决方案，帮助AI助手正确发送Telegram语音消息。解决WAV格式错误、缺少asVoice参数、TTS音频URL过期等常见问题。

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:51 PM UTC
• Version: 1.0.0

Overview

The skill has a legitimate Telegram voice-message purpose, but it includes unsafe runnable scripts and examples that could allow command execution or unauthenticated message sending.

Install only if you are prepared to review and harden the scripts first. Avoid the webhook, remote config, eval, shell=True, and named-pipe examples as written; keep Telegram/TTS tokens scoped and separate from media-processing subprocesses, and do not expose any listener publicly without authentication and rate limits.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docs/api-integration.md:793
• Finding: Remote Configuration Is Converted into Shell Code and Executed<![CDATA[ ## Vulnerability Details **File Location**: `docs/api-integration.md`, lines 793-801 **Vulnerability Type**: T03: Remote Payload Retrieval and Execution **Risk Level**: Critical ### Vulnerable Code ```bash # 从远程配置服务加载配置 load_config_from_remote() { local config_url="${1:-"https://config.example.com/telegram-voice"}" curl -s "$config_url" \ | jq -r 'to_entries|map("export \(.key)=\(.value|tostring)")|.[]' \ > /tmp/remote_config.sh source /tmp/remote_config.sh } ``` ### Technical Analysis The function accepts a caller-controlled configuration URL, downloads JSON from that location, converts its keys and values into shell statements, and executes the generated file with `source`. The generated assignments are not safely shell-escaped. A configuration value containing shell syntax, command substitution, or statement separators can therefore alter the generated script and execute commands. Because `source` runs in the current shell, the payload inherits the invoking process's environment, working directory, filesystem access, and credentials. The implementation provides no trusted-origin allowlist, response signature, checksum, schema enforcement, or safe parsing boundary. It also writes to the predictable shared path `/tmp/remote_config.sh`, creating an additional opportunity for local race-condition or symlink attacks. This remote execution mechanism is unnecessary for the Skill's declared purpose of generating, converting, and sending Telegram voice messages. ### Attack Path 1. An attacker persuades the user or Agent to invoke `load_config_from_remote` with an attacker-controlled URL, or compromises the configured remote service. 2. The remote server returns JSON containing a value that becomes executable shell syntax after the `jq` transformation. 3. The function writes the generated statements to `/tmp/remote_config.sh`. 4. The function executes the file using `source`. 5. The attacker's commands run with the privileges an ...[truncated 742 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the generation and sourcing of shell scripts from remote configuration. - Parse configuration strictly as data and assign only explicitly allowlisted keys. - Enforce a schema defining permitted keys, value types, lengths, and formats. - Do not use `eval`, `source`, command substitution, or generated `export` statements for configuration data. - If remote configuration is essential, restrict requests to a pinned HTTPS origin and authenticate responses with a cryptographic signature. - Reject redirects to untrusted hosts and apply connection, response-size, and total-time limits. - Use `mktemp` inside a private directory with mode `0700` if temporary storage is unavoidable. - Never use a predictable shared `/tmp` filename. - Run the configuration loader without sensitive credentials in its environment. A safer pattern is to extract each permitted value directly: ```bash telegram_chat_id=$(jq -er '.telegram_chat_id | strings' "$config_file") audio_bitrate=$(jq -er '.audio_bitrate | strings' "$config_file") case "$audio_bitrate" in 32k|64k|96k|128k) ;; *) echo "Invalid bitrate" >&2; return 1 ;; esac ``` ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/audio_converter.sh:170
• Finding: Command Injection through eval in the Audio Converter<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audio_converter.sh`, lines 170-180 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```bash local ffmpeg_cmd="ffmpeg -i \"$input_file\" \ -acodec $DEFAULT_CODEC \ -b:a \"$bitrate\" \ -ar \"$sample_rate\" \ -ac \"$channels\" \ \"$output_file\" \ -y" # 运行ffmpeg，捕获输出 local ffmpeg_output if ffmpeg_output=$(eval "$ffmpeg_cmd" 2>&1); then ``` ### Technical Analysis The script constructs an ffmpeg command as a string and reparses it with `eval`. The string includes values originating from command-line arguments: - Input file path. - Output file path. - `--bitrate`. - `--sample-rate`. - `--channels`. Quoting values while constructing the string does not make them safe because `eval` performs another round of shell parsing. A value that terminates the intended quoting context or contains command substitution can introduce an additional shell command. No strict allowlist validation is applied to the audio option values before they reach `eval`. File existence and format checks do not prevent malicious shell syntax from appearing in a valid filename. ### Attack Path 1. An attacker controls a filename, output path, or audio option passed to `audio_converter.sh`. 2. The supplied value contains shell syntax designed to escape the command's intended argument context. 3. The script inserts the value into `ffmpeg_cmd`. 4. `eval` reparses the entire command string. 5. The injected command executes with the privileges of the user running the converter. A realistic exposure exists when an Agent processes uploaded files whose names are attacker-controlled or forwards user-provided conversion options. ### Impact Assessment Successful exploitation provides arbitrary local command execution as the invoking user. The attacker could: - Read or modify files available to the Skill process. - Access exported Telegram and TTS credentials. ...[truncated 329 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove `eval` and invoke ffmpeg directly with separately quoted arguments: ```bash local ffmpeg_output if ffmpeg_output=$(ffmpeg \ -i "$input_file" \ -acodec "$DEFAULT_CODEC" \ -b:a "$bitrate" \ -ar "$sample_rate" \ -ac "$channels" \ "$output_file" \ -y 2>&1); then ``` Apply strict validation before execution: ```bash [[ "$bitrate" =~ ^[0-9]+k$ ]] || { log_error "Invalid bitrate" return 1 } [[ "$sample_rate" =~ ^[0-9]+$ ]] || { log_error "Invalid sample rate" return 1 } [[ "$channels" =~ ^[12]$ ]] || { log_error "Invalid channel count" return 1 } ``` Additional hardening should include: - Prefixing file operands with `--` where supported. - Rejecting unsafe or unexpected output locations. - Running media processing in a sandbox with no access to API credentials. - Applying file-size, duration, and processing-time limits. - Adding regression tests using filenames containing spaces, quotes, semicolons, dollar signs, and command-substitution characters. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: docs/api-integration.md:887
• Finding: Generic Arbitrary-Command Executors Using eval and Predictable Named Pipes<![CDATA[ ## Vulnerability Details **File Location**: `docs/api-integration.md`, lines 887-936 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```bash # 批量API调用 batch_api_calls() { local operations=("$@") local batch_size=10 # 每批10个操作 local total=${#operations[@]} for ((i=0; i<total; i+=batch_size)); do local batch=("${operations[@]:i:batch_size}") # 并行处理批次 for operation in "${batch[@]}"; do eval "$operation" & done # 等待批次完成 wait echo "✅ 完成批次 $((i/batch_size + 1))" # 避免触发速率限制 sleep 1 done } # 简单的连接池实现 create_connection_pool() { local pool_size="${1:-5}" for ((i=0; i<pool_size; i++)); do # 创建命名管道作为连接 mkfifo "/tmp/connection_$i" # 启动后台进程处理连接 ( while true; do read -r command < "/tmp/connection_$i" eval "$command" done ) & done } # 使用连接池 use_connection_pool() { local command="$1" # 找到可用的连接 for pipe in /tmp/connection_*; do if [ -p "$pipe" ]; then echo "$command" > "$pipe" break fi done } ``` ### Technical Analysis The batch API helper treats each input string as shell code and executes it using `eval`. Any untrusted data incorporated into an operation becomes an arbitrary-command execution vector. The connection-pool example creates predictable FIFOs under `/tmp`, reads text from them, and passes that text directly to `eval`. It does not create a private directory, enforce restrictive permissions, verify FIFO ownership, authenticate writers, or restrict commands to an allowlist. The worker processes run indefinitely in the background. This broad command-execution interface is not required to call TTS or Telegram APIs and breaks the principle of least privilege. ### Attack Path For the batch helper: 1. An attacker influences an operation string passed to `batch_api_calls`. 2. The string includes an unintended shell command. 3. `eval "$ ...[truncated 1117 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove every use of `eval`. - Represent operations as structured names plus argument arrays rather than executable strings. - Dispatch only through a fixed allowlist: ```bash run_operation() { local operation="$1" shift case "$operation" in send_voice) send_telegram_voice "$@" ;; generate_tts) generate_tts "$@" ;; *) echo "Unsupported operation" >&2; return 1 ;; esac } ``` - Do not use shell command strings as inter-process messages. - Replace the named-pipe design with a structured queue containing validated JSON or another non-executable format. - If FIFOs are necessary, create them inside a private directory produced by `mktemp -d`, set mode `0700`, and verify ownership and file type before every use. - Add termination handling and remove FIFOs when workers exit. - Apply concurrency, queue-size, execution-time, and resource limits. - Run workers under a dedicated account without access to unrelated files or credentials. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: docs/api-integration.md:657
• Finding: Unauthenticated Webhook Listener Triggers TTS and Telegram Processing<![CDATA[ ## Vulnerability Details **File Location**: `docs/api-integration.md`, lines 657-708 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: High ### Vulnerable Code ```bash # 简单的Webhook服务器 start_webhook_server() { local port="${1:-8080}" # 使用Python启动简单服务器 cat > /tmp/webhook_server.py << 'EOF' from http.server import HTTPServer, BaseHTTPRequestHandler import json import subprocess import threading class WebhookHandler(BaseHTTPRequestHandler): def do_POST(self): content_length = int(self.headers['Content-Length']) post_data = self.read.rfile.read(content_length) try: data = json.loads(post_data.decode('utf-8')) text = data.get('text', '') # 在新线程中处理，避免阻塞 thread = threading.Thread(target=process_webhook, args=(text,)) thread.start() self.send_response(202) self.send_header('Content-Type', 'application/json') self.end_headers() self.wfile.write(json.dumps({'status': 'accepted'}).encode()) except Exception as e: self.send_response(400) self.send_header('Content-Type', 'application/json') self.end_headers() self.wfile.write(json.dumps({'error': str(e)}).encode()) def log_message(self, format, *args): # 禁用默认日志 pass def process_webhook(text): # 调用TTS生成和发送 subprocess.run([ './scripts/tts_generator.sh', text, '|', 'xargs', './scripts/telegram_sender.sh' ], shell=True) if __name__ == '__main__': server = HTTPServer(('0.0.0.0', 8080), WebhookHandler) print('Webhook服务器启动在端口 8080') server.serve_forever() EOF python3 /tmp/webhook_server.py & } ``` ### Technical Analysis The example binds the HTTP server to `0.0.0.0`, making it reachable through all available network interfaces. It accepts POST requests and initi ...[truncated 1977 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind to `127.0.0.1` by default and expose the service only through an authenticated reverse proxy when remote access is required. - Require HMAC or asymmetric-signature verification before parsing or processing the request body. - Use a constant-time comparison such as `hmac.compare_digest`. - Include timestamps and unique request identifiers in the signed content to prevent replay attacks. - Reject missing, expired, duplicated, or malformed signatures. - Apply strict request-body size limits and validate the JSON schema. - Add per-client rate limits, global concurrency limits, bounded queues, and processing timeouts. - Remove `shell=True` and invoke each program directly with an argument list. - Restrict permitted Telegram destinations rather than accepting arbitrary routing data. - Run the service under a dedicated, unprivileged account with narrowly scoped API credentials. - Correct request-body reading to use `self.rfile.read(...)`, but do not treat that correction as a substitute for authentication. - Avoid writing executable server code to predictable `/tmp/webhook_server.py`; package the server as a reviewed file or create temporary files securely. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (144)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical

• Category: YARA Match

Content

ey_id": "$ALIYUN_ACCESS_KEY_ID",
  "access_key_secret": "$ALIYUN_ACCESS_KEY_SECRET",
  "tts_appkey": "$ALIYUN_TTS_APPKEY"
}
EOF
```

#### API调用示例
```bash
# 调用阿里云TTS
call_aliyun_tts() {
  local text="$1"
  local output_file="$2"
  
  # 构建请求
  local timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
  local signature=$(generate_signature "$text" "$timestamp")
  
  # 发送请求
  curl -X POST "https://nls-gateway-cn-shanghai.aliyuncs.com/stream/v1/tts" \
    -H "Content-Type: application/json" \
    -H "Authorization: $signature" \
    -d "{
      \"appkey\": \"$ALIYUN_TTS_APPKEY\",
      \"text\": \"$text\",
      \"format\": \"wav\",
      \"sample_rate\": 16000,
      \"voice\": \"xiaoyun\",
      \"volume\": 50,
      \"speech_rate\": 0,
      \"pitch_rate\": 0
    }" \
    -o "$output_file"
  
  # 验证响应
  if [ -f "$output_file" ] && [ $(stat -c%s "$output_file") -gt 1000 ]; then
    echo "✅ TTS生成成功: $output_file"
    return 0
  else
    echo "❌

• Confidence: 85% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Chaining Abuse

High

• Category: Tool Misuse

Content

steps:
      - uses: actions/checkout@v2
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg curl jq
      - name: 运行验证

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

steps:
      - uses: actions/checkout@v2
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg curl jq
      - name: 运行验证

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

steps:
      - uses: actions/checkout@v2
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg curl jq
      - name: 运行验证

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

steps:
      - uses: actions/checkout@v2
      - name: 安装依赖
        run: |
          sudo apt-get update
          sudo apt-get install -y ffmpeg curl jq
      - name: 运行验证

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Credential Access

High

• Category: Privilege Escalation

Content

export ALIYUN_TTS_API_KEY="your_aliyun_key_here"

# 或者使用配置文件
cp templates/.env.example .env
# 编辑.env文件，填写真实值
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

export ALIYUN_TTS_API_KEY="your_aliyun_key_here"

# 或者使用配置文件
cp templates/.env.example .env
# 编辑.env文件，填写真实值
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High

• Category: Supply Chain

Content

local output_file="$2"
    
    # API调用（使用环境变量）
    curl -X POST "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation" \
        -H "Authorization: Bearer $ALIYUN_TTS_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# 自动清理临时文件
cleanup() {
    rm -f /tmp/audio_*.wav
    rm -f /tmp/audio_*.ogg
    echo "🧹 已清理临时文件"
}

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 自动清理临时文件
cleanup() {
    rm -f /tmp/audio_*.wav
    rm -f /tmp/audio_*.ogg
    echo "🧹 已清理临时文件"
}

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

generate_audio "$text" "/tmp/temp_audio.wav"
    
    # 立即清理
    shred -u "/tmp/temp_audio.wav" 2>/dev/null || rm -f "/tmp/temp_audio.wav"
}
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Ae1

High

• Category: analysis-evasion

Content

./scripts/telegram_sender.sh generated_audio.ogg

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

./scripts/telegram_sender.sh generated_audio.ogg

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The webhook server example accepts arbitrary POST requests, parses attacker-controlled JSON, and immediately processes the supplied text without invoking the documented signature verification routine. In this context, that means any network client that can reach the server can trigger downstream processing and message-sending workflows, enabling unauthorized use and making later command-injection issues easier to exploit.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The webhook example launches a network-facing server on 0.0.0.0 and processes untrusted request content by passing it into local script execution. In an agent skill, this materially increases the attack surface by turning documentation into an unsolicited remote-trigger execution path, especially when paired with missing authentication and shell invocation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def process_webhook(text):
    # 调用TTS生成和发送
    subprocess.run([
        './scripts/tts_generator.sh', text,
        '|', 'xargs', './scripts/telegram_sender.sh'
    ], shell=True)

• Confidence: 100% confidence
• Finding: The webhook handler passes attacker-controlled text into subprocess execution while also setting shell=True, and the argument list itself includes shell metacharacter pipeline elements. This creates a likely command-injection path where a crafted webhook payload can execute arbitrary shell commands on the host, making it the most severe issue in the file.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The remote configuration example downloads data from a URL, transforms it into shell export statements, writes it to a file, and then sources that file. If the remote service, transport path, or returned content is compromised, this becomes arbitrary shell code execution in the agent environment.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# ✅ 安全清理
cleanup() {
  rm -f "$temp_dir"/*.wav
  rm -f "$temp_dir"/*.ogg
  rm -f "$temp_dir"/*.tmp
}

• Confidence: 89% confidence
• Finding: The cleanup function deletes files using a wildcard under "$temp_dir" without validating that temp_dir is set to an expected safe location. If temp_dir is empty, malformed, or attacker-influenced, the command may delete unintended files in the current working directory or another sensitive path matching the pattern.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# ✅ 安全清理
cleanup() {
  rm -f "$temp_dir"/*.wav
  rm -f "$temp_dir"/*.ogg
  rm -f "$temp_dir"/*.tmp
}

• Confidence: 89% confidence
• Finding: This deletion pattern has the same weakness as the prior line: it trusts temp_dir blindly and expands a wildcard against that path. In shell scripts, unvalidated cleanup paths are a common source of accidental or attacker-triggered file deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

cleanup() {
  rm -f "$temp_dir"/*.wav
  rm -f "$temp_dir"/*.ogg
  rm -f "$temp_dir"/*.tmp
}

# 确保清理

• Confidence: 89% confidence
• Finding: The .tmp cleanup command repeats the same unsafe pattern and can delete unintended temporary files if temp_dir is misconfigured or influenced by external input. Cleanup code often runs automatically via trap, increasing the chance of non-interactive destructive behavior.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

print(f"发送语音消息: {text[:50]}...")
            
            # 设置环境变量
            env = os.environ.copy()
            env.update({
                'TELEGRAM_BOT_TOKEN': self.config['telegram_bot_token'],
                'TELEGRAM_CHAT_ID': self.config['telegram_chat_id']

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The CLI example loads configuration with `source "$CONFIG_FILE"` from a user-writable file in the home directory, which executes arbitrary shell code contained in that file. For a tool whose stated purpose is only sending Telegram voice messages, this introduces an unnecessary local code-execution path that could be abused if the file is modified by malware, another local user, or unsafe automation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# 清理临时文件
echo "🧹 清理文件..."
rm -f /tmp/test_audio.wav /tmp/test_audio.ogg

echo "✅ 消息发送完成！"
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

./scripts/tts_generator.sh "告警：$message" /tmp/alert.wav
        ./scripts/audio_converter.sh /tmp/alert.wav /tmp/alert.ogg
        TELEGRAM_CHAT_ID="$TELEGRAM_ALERT_CHAT_ID" ./scripts/telegram_sender.sh /tmp/alert.ogg
        rm -f /tmp/alert.wav /tmp/alert.ogg
    fi
}

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

rm -rf "$TEMP_DIR" 2>/dev/null || true
    
    # 可选：清理旧的临时文件
    find /tmp -name "telegram_voice_*" -type d -mtime +1 2>/dev/null | xargs rm -rf 2>/dev/null || true
    
    log_success "清理完成"
}

• Confidence: 90% confidence
• Finding: The cleanup routine pipes find results into xargs rm -rf for directories under /tmp matching a broad pattern. This is dangerous because /tmp is attacker-writable: crafted filenames with whitespace/newlines can be mishandled by xargs, and the script may delete directories it did not create, enabling unintended destructive cleanup against other users' or processes' data.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/basic-usage.md:428

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/error-examples.md:428

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: templates/config_template.py:260

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: examples/error-examples.md:447