T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_voice_feishu.sh:6- Finding
Python Code Injection Through the Recipient Identifier
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Speaker
Security checks for vulnerabilities and agentic risk
Overview
This Feishu voice skill is not clearly malicious, but it can send audio to Feishu using a local app secret and an embedded default recipient without clear user confirmation.
Review before installing. Use only with a Feishu app and recipient IDs you control, remove the embedded default recipient and app ID, require explicit recipients and files, fix the python3 -c interpolation, avoid putting secrets in process arguments, and pin dependencies before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/send_voice_feishu.sh:4- Finding
Audio Can Be Sent to a Hard-Coded Opaque Recipient
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi RECEIVER_ID="$3" ``` 3. Validate the recipient ID against the expected Feishu format. 4. Where practical, derive the destination from authenticated conversation context rather than free-form model output. 5. Support an administrator-controlled allowlist for permitted recipients. 6. Display or log the destination before transmission without exposing credentials. 7. Require explicit confirmation for sensitive or user-selected recordings. 8. Do not default to `/tmp/test_voice.ogg`; require an explicit file and verify that it is a regular file owned or approved by the caller. 9. Move application and recipient configuration to user-controlled deployment settings rather than shipping package-specific identifiers. ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:32- Finding
Unpinned Third-Party Packages Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: ``` 3. For Node.js, provide `package.json` and a committed lockfile, then use `npm ci` instead of global installation. 4. Avoid `npm install -g` and ad hoc `npx` execution. 5. If `npx` is unavoidable, specify an exact reviewed version and disable prompts, while recognizing that this remains weaker than a locked local installation. 6. Document the verified package publisher and canonical source repository. 7. Use automated dependency scanning and review updates before changing pinned versions. 8. Recommend installation in a minimally privileged environment or container. 9. Pin or document trusted operating-system package sources for FFmpeg. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/send_voice_feishu.sh:17- Finding
Feishu App Secret Is Exposed Through Process Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented behavior claims a bidirectional voice workflow, but the finding indicates the actual capability includes undeclared local credential access and omits major advertised functions. This mismatch is dangerous because users and reviewers may consent to a harmless-looking media utility while it performs sensitive actions such as reading secrets or sending data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill instructs storage and use of a Feishu App Secret from a local credential file, which is sensitive authentication material. Accessing such a secret is inherently high-risk in an agent skill because compromise or misuse could enable unauthorized API actions, impersonation, or message sending through the linked Feishu application.
- Content
1. 配置飞书API凭证
创建文件
~/.openclaw/.credentials/feishu-app-secret.txt：text 你的飞书App Secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # 用法: send_voice_feishu.sh <音频文件.ogg> [时长毫秒] [接收者ID] APP_ID="cli_a9037acd2ba19bb5" APP_SECRET_FILE="${HOME}/.openclaw/.credentials/feishu-app-secret.txt" RECEIVER_ID="${3:-ou_94f3936f1896b5378404f377da3fae6f}" # 读取App Secret
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh FILE_PATH="${1:-/tmp/test_voice.ogg}" DURATION="${2:-4650}" # 获取access token get_token() { local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh FILE_PATH="${1:-/tmp/test_voice.ogg}" DURATION="${2:-4650}" # 获取access token get_token() { local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # 获取access token get_token() { local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\": \"$APP_ID\", \"app_secret\": \"$APP_SECRET\"}")
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh local file_path="$2" local duration="$3" local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $token" \ -F "file_type=opus" \ -F "file_name=voice.ogg" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh # 使用Python构造正确的JSON local json_payload=$(python3 -c "import json; print(json.dumps({\"receive_id\": \"$RECEIVER_ID\", \"msg_type\": \"audio\", \"content\": json.dumps({\"file_key\": \"$file_key\"})}))") local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \ -H "Authorization: Bearer $token" \ -H "Content-Type: application/json" \ -d "$json_payload")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents multiple shell-based operations (pip, npm, apt/brew, ffmpeg, CLI execution) but does not declare any explicit tool scope or permissions. This creates a trust and review gap: an agent may execute shell commands the user did not clearly authorize, including package installation or message-sending actions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
Using 'npx edge-tts' without a pinned version allows execution of whatever package version is currently resolved at runtime. If the upstream package is compromised or a breaking version is published, the skill could run untrusted code on the host.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The default voice is hard-coded to "zh-CN-YunxiNeural", which sets a specific language/locale by default. Under the policy, locale constraints should either offer user choice or be clearly documented and justified; this JSON file shows neither.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script uploads a caller-supplied audio file to Feishu and can send it to a hard-coded default recipient without any confirmation, warning, or visibility into where the data is going. In an agent-skill context, this increases the risk of unintended exfiltration of sensitive voice content because a user may omit the recipient argument and still transmit private data externally.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # 获取access token get_token() { local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\": \"$APP_ID\", \"app_secret\": \"$APP_SECRET\"}")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
This request sends a message to Feishu using a recipient that defaults to a preconfigured open_id, which can cause silent transmission to an unintended party if the caller does not override it. In a skill context, outbound messaging is expected, but the hidden default recipient makes accidental data disclosure materially more dangerous.
- Content
sh # 使用Python构造正确的JSON local json_payload=$(python3 -c "import json; print(json.dumps({\"receive_id\": \"$RECEIVER_ID\", \"msg_type\": \"audio\", \"content\": json.dumps({\"file_key\": \"$file_key\"})}))") local response=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \ -H "Authorization: Bearer $token" \ -H "Content-Type: application/json" \ -d "$json_payload")
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The command help states the
--languageoption defaults tozh, and elsewhere the documentation repeatedly frames the tool around Chinese-only speech/text behavior. Because the skill does not present this as an explicit user choice or a justified region-specific constraint, it appears to impose a locale default in natural-language documentation.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's comments, usage text, and runtime status/error messages are all in Chinese, which imposes a specific language on users. There is no indication that this is a region-specific tool or that users can opt into another language, so it appears to violate the language/locale policy criterion.
- Content
Static analysis
No suspicious patterns detected.