Security audit

Podcast Automation

Security checks for vulnerabilities and agentic risk

Overview

The skill performs a disclosed podcast workflow with Feishu archiving and Sonos control, with notable but purpose-aligned dependency and data-sharing risks.

Install and run this only in an environment where you are comfortable using unpinned third-party tools. Treat Feishu transcripts as data sent to a third-party workspace, verify the target Wiki space before uploading, keep FEISHU_APP_SECRET scoped and rotated, and confirm the intended Sonos speaker and volume before playback.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party Dependencies Permit Mutable Supply-Chain Code Execution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:10-19 and SKILL.md:30-33
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill installs third-party Python and Go packages without pinning reviewed versions or verifying package integrity. The Go dependency explicitly uses the mutable @latest version.

yaml
metadata: openclaw: requires: bins: ["whisper", "sonos", "curl"] install: - id: whisper kind: pip package: openai-whisper bins: ["whisper"] label: Install Whisper (pip) - id: sonos kind: go module: github.com/steipete/sonoscli/cmd/sonos@latest bins: ["sonos"] label: Install sonoscli (go)

The documentation repeats the unpinned installation instructions:

bash
pip install yt-dlp pip install openai-whisper go install github.com/steipete/sonoscli/cmd/sonos@latest

Technical Analysis

Package installation is functionally relevant because the Skill requires transcription, media downloading, and Sonos control tools. However, resolving unrestricted package versions is not necessary for those functions and exceeds the minimum supply-chain trust required.

openai-whisper and yt-dlp are installed without exact versions or hashes. The Sonos utility is installed with @latest, so the code selected during installation may change after this Skill has been reviewed. Depending on the package manager and package implementation, installation can execute dependency-controlled compilation, build hooks, or other local code. The resulting binaries also execute with the invoking user's privileges when the Skill uses them.

No dependency lockfile, package hash, immutable Go commit, signature verification, or allowlisted artifact digest is provided. Consequently, compromise of an upstream maintainer account, source repository, release process, package registry, or transit ...[truncated 2036 chars]
Remediation: View remediation
Remediation Suggestions

Pin each Python package to an explicitly reviewed version, for example openai-whisper==<reviewed-version> and yt-dlp==<reviewed-version>.

Replace the Go @latest selector with a reviewed semantic version or, preferably, an immutable commit revision.

Maintain a lockfile or constraints file that records direct and transitive dependency versions.

Require cryptographic hashes for Python artifacts where supported, such as a hash-locked requirements file installed with pip --require-hashes.

Fetch packages only from explicitly trusted registries and disable unintended fallback indexes to reduce dependency-confusion exposure.

Verify release signatures or published checksums when upstream projects provide them.

Perform installation in an isolated, non-administrative environment with restricted filesystem, credential, and network access.

Separate dependency installation from normal Skill execution so dependency updates require explicit review rather than occurring implicitly.

Document a controlled update process that reviews source changes, refreshes hashes, and tests the pinned versions before deployment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code’s behavior is narrowly focused on one part of the declared workflow: archiving transcript content to Feishu Wiki. It does not download podcasts, transcribe audio, or control/play content on Sonos. While the archival portion matches the description, the declared purpose presents the skill as a broader full-process automation capability than this code chunk actually implements. This is a material description-to-behavior mismatch in primary scope, though there are no obvious undeclared capabilities beyond Feishu API access needed for wiki archival.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
1.1 直链下载

bash
curl -L -o /tmp/podcast.mp3 "https://example.com/episode.mp3"

1.2 RSS 解析 + 下载

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
enc = root.find('.//item/enclosure') print(enc.get('url') if enc is not None else '') ") curl -L -o /tmp/podcast.mp3 "$AUDIO_URL"

text
### 1.3 yt-dlp（支持 YouTube / Spotify 等平台）

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
enc = root.find('.//item/enclosure') print(enc.get('url') if enc is not None else '') ") curl -L -o /tmp/podcast.mp3 "$AUDIO_URL"

text
### 1.3 yt-dlp(支持 YouTube / Spotify 等平台)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/scripts/archive-to-wiki.sh (reported line 24)May include surrounding context.
sh
: "${TRANSCRIPT_FILE:?--transcript is required}" # Get token TOKEN=$(curl -s -X POST \ 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # Create page RESULT=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/scripts/archive-to-wiki.sh (reported line 31)May include surrounding context.
sh
| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # Create page RESULT=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill clearly instructs the agent to use shell-capable actions (curl, python3, whisper, sonos, bash) but does not declare any explicit tool scope or allowed-tools boundary. This weakens containment and reviewability because a runtime may permit broader shell execution than users expect, increasing the chance of unintended network access, file writes, and device control.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill supports uploading transcripts to Feishu Wiki, which may contain sensitive or copyrighted content, but it does not prominently warn users that local transcript data will be transmitted to a third-party SaaS. Missing disclosure undermines informed consent and can lead to accidental data leakage in a context where transcription text may include confidential information.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
enc = root.find('.//item/enclosure') print(enc.get('url') if enc is not None else '') ") curl -L -o /tmp/podcast.mp3 "$AUDIO_URL"

text
### 1.3 yt-dlp（支持 YouTube / Spotify 等平台）

External Transmission

Medium

Category: Data Exfiltration
Confidence: 87% confidence
Finding: This step sends authenticated requests to Feishu to create wiki content, constituting external transmission to a third-party service. In this skill’s context that behavior is expected, but it is still security-relevant because it uses bearer tokens and creates externally stored records that may expose sensitive content or metadata if done without explicit user awareness.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
bash
SPACE_ID="your_space_id" RESULT=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill reads the full transcript from local storage and posts it to Feishu, which can transfer large amounts of potentially sensitive spoken content to a third-party service. This is more dangerous than ordinary network use because transcripts may contain private discussions, secrets, or regulated data, and the upload occurs in a single opaque API call.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
bash
TRANSCRIPT=$(cat /tmp/podcast-out/podcast.txt) curl -s -X POST \ "https://open.feishu.cn/open-apis/docx/v1/documents/$OBJ_TOKEN/blocks/$OBJ_TOKEN/children" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Lines L18-L19 require FEISHU_APP_ID and FEISHU_APP_SECRET, which are sensitive credentials, but the script provides no comment, prompt, or user-facing notice that it will consume these secrets to authenticate to an external service. Aside from the Chinese title line, there is no disclosure in this file explaining the credential use or its implications.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/scripts/archive-to-wiki.sh (reported line 24)May include surrounding context.
sh
: "${TRANSCRIPT_FILE:?--transcript is required}" # Get token TOKEN=$(curl -s -X POST \ 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/scripts/archive-to-wiki.sh (reported line 31)May include surrounding context.
sh
| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # Create page RESULT=$(curl -s -X POST \ "https://open.feishu.cn/open-apis/wiki/v2/spaces/$SPACE_ID/nodes" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: This request uploads the full transcript content from a local file to Feishu without any validation, classification, size limits, or confirmation of sensitivity. In an automation context, that can unintentionally exfiltrate confidential or regulated content to an external SaaS if upstream inputs are untrusted or if operators misunderstand what files are being archived.
Content: Scanner excerpt · references/scripts/archive-to-wiki.sh (reported line 43)May include surrounding context.
sh
# Write transcript TRANSCRIPT=$(cat "$TRANSCRIPT_FILE" | python3 -c "import sys,json; print(json.dumps(sys.stdin.read()))") curl -s -X POST \ "https://open.feishu.cn/open-apis/docx/v1/documents/$OBJ_TOKEN/blocks/$OBJ_TOKEN/children" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The Sonos section allows discovery, playback, and volume changes on local-network devices without an upfront warning that actions take effect immediately on physical devices. In context, this can surprise users, disrupt nearby people, or control the wrong speaker if device selection is mistaken.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Remediation Suggestions

SkillSpector

Tp4

External Script Fetching

1.1 直链下载

1.2 RSS 解析 + 下载

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Undeclared Tool Scope

Missing User Warnings

External Transmission

External Transmission

External Transmission

Missing User Warnings

External Transmission

External Transmission

External Transmission

Missing User Warnings

Static analysis