Byted Voice To Text

• Outcome: Review
• Latest audit: May 28, 2026 · 6:17 AM UTC
• Version: 1.0.0

Overview

This skill performs the advertised cloud voice transcription, but it also has under-disclosed system-install and API-key management behaviors that need review before use.

Review before installing. Use it only if you are comfortable sending audio to Volcengine/Feishu-related services. Prefer preinstalling ffmpeg/ffprobe yourself, set MODEL_SPEECH_API_KEY explicitly through your normal secret-management path, and avoid exposing ARK_SKILL_API_KEY or ARK_SKILL_API_BASE to this skill unless you intentionally want it to manage API keys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tainted flow: 'ASR_ENDPOINT' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

}

    log("正在调用火山引擎 ASR...")
    resp = requests.post(ASR_ENDPOINT, json=payload, headers=headers, timeout=60)

    status_code = resp.headers.get("X-Api-Status-Code", "")
    if status_code != "20000000":

• Confidence: 86% confidence
• Finding: The ASR endpoint is fully overrideable via the MODEL_SPEECH_ASR_API_BASE environment variable, and the script posts base64-encoded audio plus authentication headers to that URL. In agent/runtime environments where untrusted parties can influence environment configuration, this becomes an exfiltration primitive that can redirect sensitive audio and API credentials to an attacker-controlled server.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill declares only environment requirements in metadata, but the instructions clearly require shell execution, network access to external ASR services, and environment-variable handling. This under-declaration weakens sandboxing, auditability, and user trust because operators may approve the skill without realizing it can execute commands and transmit data externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The documented behavior goes beyond simple speech-to-text: it includes automatic package installation and, per the finding, API key creation/storage into environment variables and .env files. These are materially different, higher-risk actions because they modify the host and potentially persist sensitive credentials, creating a larger attack surface than users would expect from an ASR skill.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill claims to perform speech-to-text, but this function also discovers, creates, and stores cloud API keys. That expands the trust boundary beyond transcription into credential lifecycle management, which is unnecessary for the stated purpose and increases the risk of unauthorized key creation, persistence, and later misuse.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can call CreateAPIKey and then persist the returned credential locally, giving the skill the ability to mint reusable cloud credentials at runtime. In a transcription skill, this is a high-risk overreach because a compromised or abused skill could generate credentials that outlive the session and enable broader service access.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This script can perform privileged system modification by automatically running package-manager installs and, on RHEL-like systems, enabling additional repositories and installing RPMs from external URLs. That behavior exceeds a voice-to-text skill's stated purpose, increasing supply-chain and host-integrity risk if the skill is executed in sensitive environments or with elevated privileges.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to automatically install ffmpeg/ffprobe via a system-level action before asking the user. Silent package installation modifies the host environment, may require elevated privileges, and can introduce supply-chain or stability risks without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill processes local audio files, Feishu voice messages, and audio URLs by sending them to an external ASR provider, but the description does not clearly warn about this data transfer. That creates a privacy and compliance risk, especially if audio contains sensitive personal, corporate, or regulated information.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The function writes a newly obtained API key to a local .env file without any visible user consent or disclosure in the code path. Persisting long-lived secrets on disk increases exposure to accidental leakage through filesystem access, backups, logs, packaging, or later exfiltration by other components.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill makes authenticated network calls using a bearer token to list and create API keys, but there is no user-facing disclosure or indication that it is performing credential-management operations. Hidden credential-bearing requests are dangerous because they can silently expand access, enumerate secrets, or create new ones outside the user's expectations for a voice transcription feature.

Missing User Warnings

Medium

• Confidence: 71% confidence
• Finding: The skill downloads audio from Feishu and transmits audio content to an external ASR provider, but the code contains no explicit consent, notice, or policy gating for potentially sensitive voice data. In a messaging/agent context, voice messages may contain personal, confidential, or regulated information, so silent third-party transfer increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This skill sends audio content, and for local files the entire file contents, to a third-party ASR service but provides no explicit runtime privacy notice, consent check, or data-handling warning. In an agent context, users may reasonably assume attached voice messages are processed locally or may not realize that potentially sensitive speech is being transferred to an external provider, creating privacy and compliance risk.

Static analysis

No suspicious patterns detected.