ClawHub
Back to skill

Security audit

Xiaomi-any2speech

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent speech-generation tool, but it needs review because it enables voice cloning and external voice-message delivery without enough consent and recipient safeguards.

Install only if you are comfortable sending source text, files, URLs, and reference voice samples to the Xiaomi speech service. Use voice cloning only for your own voice or voices you are authorized to use, and verify any Feishu CHAT_ID/token setup before asking it to send audio to a chat.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:20
Finding

Hardcoded Shared API Credential

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill prominently supports voice cloning and mimicry but provides no consent, authorization, or privacy safeguards for using reference audio. In context, this is especially dangerous because the core feature is impersonation-capable synthesis, which can enable fraud, harassment, or deceptive communications using someone else's voice.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

bash
OUTPUT=output_$(date +%s).wav
curl -X POST "$BASE/v1/audio/generate" \
  -H "Authorization: Bearer $API_KEY" \
  -F "source_type=text" \
  -F "text=内容" \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
echo "已提交: $JOB"

for i in $(seq 1 60); do
  STATUS=$(curl -s -H "Authorization: Bearer $API_KEY" \
    "$BASE/v1/audio/jobs/$JOB" \
    | python3 -c "import sys,json; print(json.load(sys.stdin)['status'])")
  [ "$STATUS" = "done" ]   && break

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

done [ "$STATUS" != "done" ] && echo "轮询超时" && exit 1

curl -s -H "Authorization: Bearer $API_KEY"
"$BASE/v1/audio/jobs/$JOB/download" --output "$OUTPUT" echo "✓ 保存至 $OUTPUT"

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

done [ "$STATUS" != "done" ] && echo "轮询超时" && exit 1

curl -s -H "Authorization: Bearer $API_KEY"
"$BASE/v1/audio/jobs/$JOB/download" --output "$OUTPUT" echo "✓ 保存至 $OUTPUT"

text

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
| `req_id` | synthesize | 来自 think 返回值 |
| `script_lines_json` | synthesize | 可选，编辑后脚本 `[{"speaker":"..","text":".."},...]` |

> 降噪预览（不合成，仅试听降噪效果）：`curl -X POST "$BASE/v1/audio/vp/denoise" -H "Authorization: Bearer $API_KEY" -F "voice_file=@ref.webm" --output denoised.wav`。当前返回标准 WAV，采样率为 48kHz。

### VP 模板（预置脚本，不需要输入文本）

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
| `req_id` | synthesize | 来自 think 返回值 |
| `script_lines_json` | synthesize | 可选,编辑后脚本 `[{"speaker":"..","text":".."},...]` |

> 降噪预览(不合成,仅试听降噪效果):`curl -X POST "$BASE/v1/audio/vp/denoise" -H "Authorization: Bearer $API_KEY" -F "voice_file=@ref.webm" --output denoised.wav`。当前返回标准 WAV,采样率为 48kHz。

### VP 模板(预置脚本,不需要输入文本)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
# 返回 req_id / speakers / summary / sentence_count / script_lines
TITLE="罗永浩、王自如的世纪骂战"
ENCODED=$(python3 -c "import sys,urllib.parse; print(urllib.parse.quote(sys.argv[1]))" "$TITLE")
PREP=$(curl -s -X POST "$BASE/v1/audio/vp/templates/$ENCODED/prepare" \
  -H "Authorization: Bearer $API_KEY")
REQ_ID=$(echo "$PREP" | python3 -c "import sys,json; print(json.load(sys.stdin)['req_id'])")
echo "$PREP" | python3 -c "import sys,json; d=json.load(sys.stdin); print('speakers:', d['speakers'])"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

前置：FEISHU_TENANT_TOKEN（或 APP_ID + APP_SECRET）、CHAT_ID、可选 ffmpeg/ffprobe。

bash
[ -z "$FEISHU_TENANT_TOKEN" ] && FEISHU_TENANT_TOKEN=$(curl -s -X POST \
  "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 252)May include surrounding context.

md
| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")
ffmpeg -y -i "$OUTPUT" -c:a libopus -b:a 32k output.opus 2>/dev/null && UPLOAD=output.opus || UPLOAD="$OUTPUT"
DURATION_MS=$(ffprobe -v quiet -show_entries format=duration -of csv=p=0 "$OUTPUT" | awk '{printf "%d",$1*1000}')
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \
  -H "Authorization: Bearer $FEISHU_TENANT_TOKEN" \
  -F "file=@$UPLOAD" -F "file_type=opus" -F "file_name=tts.opus" -F "duration=$DURATION_MS" \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are extremely broad and include generic requests like read aloud, generate audio, narrate, make it listenable, and send as voice. Overbroad invocation can cause the skill to activate unintentionally in contexts involving sensitive text or audio, increasing the chance of unwanted transmission to external services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill extends beyond speech generation into Feishu delivery and credential handling, including obtaining a tenant token and sending messages/files to a chat. This broadens the trust boundary and creates an additional exfiltration path for generated audio and associated content if invoked improperly or with misconfigured environment variables.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This code sends app credentials to Feishu to obtain a tenant token, introducing external credential transmission beyond the primary TTS service. While expected for Feishu integration, it still increases exposure because secrets are used in shell commands and outbound network calls within the skill workflow.

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

前置：FEISHU_TENANT_TOKEN（或 APP_ID + APP_SECRET）、CHAT_ID、可选 ffmpeg/ffprobe。

bash
[ -z "$FEISHU_TENANT_TOKEN" ] && FEISHU_TENANT_TOKEN=$(curl -s -X POST \
  "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \
  -H "Content-Type: application/json" \
  -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill can transmit generated audio to an external Feishu chat, which is an outbound data transfer path. If triggered accidentally or with the wrong CHAT_ID, sensitive generated content could be delivered to unintended recipients outside the original execution context.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

-H "Authorization: Bearer $FEISHU_TENANT_TOKEN"
-F "file=@$UPLOAD" -F "file_type=opus" -F "file_name=tts.opus" -F "duration=$DURATION_MS"
| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])") curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=chat_id"
-H "Authorization: Bearer $FEISHU_TENANT_TOKEN" -H "Content-Type: application/json"
-d "{"receive_id":"$CHAT_ID","msg_type":"audio","content":"{\"file_key\":\"$FILE_KEY\"}"}"

text

Static analysis

No suspicious patterns detected.