Feishu Send Voice

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:45 AM UTC
• Version: 0.1.0

Overview

This skill does what it claims: it turns text into a Feishu voice message, with some privacy and dependency cautions to understand before use.

Install only if you are comfortable sending the provided text through edge-tts and Feishu, and using Feishu app credentials from environment variables or ~/.openclaw/openclaw.json. Prefer a pinned, reviewed edge-tts installation in an isolated environment, and avoid sending secrets or regulated content as voice-message text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/send_feishu_voice.sh:64

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-58 and scripts/send_feishu_voice.sh:64-70
Vulnerability Type: Unpinned third-party dependency and unsafe executable resolution
Risk Level: Medium

The installation guidance recommends obtaining edge-tts from PyPI without a version constraint, hash verification, or lockfile:

text

- 缺少依赖：按报错安装（例如 `python3 -m pip install --user edge-tts`）

The script then executes either an edge-tts program discovered through PATH, a fixed user-local executable, or the installed Python module:

bash

EDGE_TTS_CMD=""
if command -v edge-tts >/dev/null 2>&1; then
  EDGE_TTS_CMD="edge-tts"
elif [[ -x "$HOME/Library/Python/3.14/bin/edge-tts" ]]; then
  EDGE_TTS_CMD="$HOME/Library/Python/3.14/bin/edge-tts"
else
  # 尝试 python 模块方式
  if python3 -m edge_tts --help >/dev/null 2>&1; then
    EDGE_TTS_CMD="python3 -m edge_tts"
  else
    echo "edge-tts not found. install with: python3 -m pip install --user edge-tts" >&2
    exit 6
  fi
fi

Technical Analysis

The documented command installs the latest dependency version and its transitive dependencies from the configured Python package index. The project does not constrain the version, verify package hashes, provide a lockfile, or identify a reviewed artifact. Consequently, the effective code installed by users can change after this Skill has been reviewed.

In addition, command -v edge-tts trusts the first matching executable in the caller's PATH. A malicious or compromised executable earlier in PATH would be selected without validating its location or integrity.

This is a supply-chain weakness rather than evidence that the currently named package is malicious.

Attack Path

1. An attacker compromises a future package release, a transitive dependency, the configured package index, or places a malicious edge-tts executable earlier in the victim's PATH.

...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

• Pin edge-tts and its transitive dependencies to reviewed versions in a lockfile or constraints file.
• Require package hashes, such as with pip install --require-hashes -r requirements.txt.
• Install dependencies in a dedicated virtual environment rather than the user's general environment.
• Document the approved package index and prevent fallback to untrusted indexes.
• Resolve the executable to an expected absolute path and reject unexpected locations.
• Prefer invoking a dependency from the controlled virtual environment, for example $VENV/bin/python -m edge_tts.
• Periodically review and update pinned dependencies after integrity and security checks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

- `scripts/send_feishu_voice.sh`：完整自动化脚本（TTS + 转码 + 上传 + 发送）

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill invokes shell-based automation and reads local configuration/secrets, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: an agent or reviewer may not realize the skill can execute commands, access local files, and use Feishu credentials to send messages on a user's behalf. In this context, the risk is elevated because the documented workflow includes reading ~/.openclaw/openclaw.json and using app secrets for outbound messaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

User-supplied text is sent to an external TTS service via edge-tts and the resulting content is then uploaded to Feishu, but the script provides no disclosure or consent prompt about this network transmission. If users pass sensitive content, they may unintentionally expose private or regulated data to third-party services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/send_feishu_voice.sh (reported line 96)May include surrounding context.

sh

)

# 3) 获取 tenant_access_token
TOK_JSON=$(curl -sS -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \
  -H 'Content-Type: application/json; charset=utf-8' \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}")
TOK_CODE=$(python3 - <<'PY' "$TOK_JSON"

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest describes converting text to speech and sending it via Feishu, but does not mention accessing local application configuration to retrieve credentials. Reading $HOME/.openclaw/openclaw.json is an additional capability involving local config access, which is not obviously part of the user-facing purpose as stated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script accesses sensitive application credentials from ~/.openclaw/openclaw.json and environment variables (FEISHU_APP_ID, FEISHU_APP_SECRET) to authenticate to Feishu. There is no user-facing notice or warning that credentials will be read and used, only error messages when values are missing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.