Security audit
Security checks across malware telemetry and agentic risk
This Telegram voice-message skill is mostly purpose-aligned, but it includes runnable examples and scripts with command-execution and unsafe automation patterns that deserve manual review before use.
Install only if you are comfortable reviewing and hardening the scripts first. Use test-only Telegram/TTS credentials, avoid sensitive text, remove eval and remote source patterns, require webhook authentication before exposing any server, disable cross-channel forwarding of original content, and store secrets in environment variables or a secret manager rather than plaintext config files.
local output_file="$2"
# API调用（使用环境变量）
curl -X POST "https://dashscope.aliyuncs.com/api/v1/services/aigc/multimodal-generation/generation" \
-H "Authorization: Bearer $ALIYUN_TTS_API_KEY" \
-H "Content-Type: application/json" \
-d "{sys.exit(1)
" | while read url; do
# 立即下载（URL可能很快过期）
curl -s -o "$output_file" "$url"
done
}#### OpenAI TTS示例
```bash
# 使用OpenAI TTS
curl https://api.openai.com/v1/audio/speech \
-H "Authorization: Bearer $OPENAI_API_KEY" \
-H "Content-Type: application/json" \
-d '{```bash
# ✅ 安全清理
cleanup() {
rm -f "$temp_dir"/*.wav
rm -f "$temp_dir"/*.ogg
rm -f "$temp_dir"/*.tmp
}# ✅ 安全清理
cleanup() {
rm -f "$temp_dir"/*.wav
rm -f "$temp_dir"/*.ogg
rm -f "$temp_dir"/*.tmp
}cleanup() {
rm -f "$temp_dir"/*.wav
rm -f "$temp_dir"/*.ogg
rm -f "$temp_dir"/*.tmp
}
# 确保清理while true; do
sleep 3600 # 每小时清理一次
find /tmp -name "telegram_voice_*" -type d -mmin +60 2>/dev/null | \
xargs rm -rf 2>/dev/null || true
done
) &
}66/66 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection