Beep - Xiao Laba

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:22 AM UTC
• Version: 2.2.0

Overview

This skill is a voice-announcement tool, but it asks to make announcements mandatory across all agent sessions, persist those rules in workspace identity and memory files, and send announcement text to a remote TTS backend without clear opt-in.

Install only if you explicitly want always-on agent voice announcements and are comfortable editing persistent workspace behavior files. Before use, remove or decline the mandatory global rules and session hooks, avoid announcing prompt or response content, and assume text sent to speech synthesis may leave the local machine through edge-tts.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:9

Finding

Mandatory Global Agent Behavior and Instruction Hijacking

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:136

Finding

Persistent Memory Poisoning and Automatic Session Hook Installation

Content

View full analysis

openclaw.json hooks run startup_check_announcement.py -> BOOTSTRAP.md loads announcement rules -> AGENTS.md loads the complete rules -> MEMORY.md loads the persistent rule table -> IDENTITY.md declares mandatory announcement behavior -> every interaction is announced ``` ### Technical Analysis The Skill explicitly directs users or Agents to write attacker-controlled behavioral rules into long-term memory and identity files. It also recommends adding automatic execut ...[truncated 1925 chars]

Remediation

View remediation

other

Error

• Location: audio_announcement/announce_helper.py:249

Finding

User-Derived Announcement Content Is Sent to a Remote TTS Service

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unhashed Runtime and Build Dependencies

Content

View full analysis

=7.2.8 pygame>=2.6.1 ``` The build dependencies are also not pinned: ```toml [build-system] requires = ["setuptools>=61.0", "wheel"] build-backend = "setuptools.build_meta" ``` The project dependencies permit future releases: ```toml dependencies = [ "edge-tts>=7.2.8", "pygame>=2.6.1; platform_system=='Windows'", ] ``` The installation documentation also recommends installing mutable package versions or a repository's default branch: ```bash pip install beep-announcement pygame git clone https://github.com/wililam/beep-announcement.git cd beep-announcement pip install -e . ``` ### Technical Analysis Minimum-version constraints allow dependency resolution to select future releases that were not reviewed with this Skill. The files also omit integrity hashes, so installers do not verify artifacts against a project-controlled digest. Cloning and installing the repository's default branch similarly permits the effective installation payload to change after the Skill documentation has been reviewed. Python build systems and dependencies can execute code during installation, making dependency provenance relevant to the security boundary. The reviewed package names and GitHub domain are recognizable and no typosquatted domain, dependency-confusion package, or known malicious component was established from the available evidence. The confirmed weakness is lack of reproducibility and integrity pinning, not proof that the current dependencies are malicious. ### Attack Path 1. A user follows the installation instructions or installs from `requirements.txt`. 2. The package manager resolves a fu ...[truncated 867 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Possible Typosquatting: 'pygame' resembles popular package 'pyyaml'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'pygame' resembles popular package 'pyyaml'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill mandates spoken summaries for every interaction, including user instructions and reply content, which creates an unnecessary side channel for potentially sensitive information. In shared or public environments, local audio playback can disclose secrets, personal data, internal prompts, or task details to bystanders without user consent.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions explicitly tell the agent to announce the content of user messages before acting, which can vocalize confidential prompts, credentials, private URLs, or sensitive operational details. Because the disclosure happens before task execution, there is little opportunity to sanitize the content first, increasing accidental leakage risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The markdown explicitly states '默认使用中文（zh）播报', which imposes a language choice by default. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is justified, which is not provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented config value 'default_lang': 'zh' establishes Chinese as the default locale, and the surrounding text does not present this as an opt-in preference. This can conflict with language/locale policy because the skill appears to assume a specific language for all users.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example code encourages directly embedding user-derived content in spoken announcements, normalizing unsafe patterns for downstream integrators. This increases the likelihood that developers will implement audio echoes of sensitive inputs, turning ordinary prompts into audible disclosures.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration section again specifies 'default_lang': 'zh', reinforcing a mandatory-looking Chinese default across the skill documentation. Because no user choice or region-specific justification is supplied, this is a policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description hardcodes bilingual announcement behavior as part of the skill's default identity rather than presenting it as an optional user preference. While not directly a code-execution issue, mandatory locale or speech behavior without consent can produce unwanted disclosures, accessibility problems, and unexpected output in environments where spoken language should be user-controlled.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest explicitly directs integration into multiple persistent identity/memory files and describes 'every interaction must announce' style behavior plus an automatic startup check. That creates an always-on behavioral modification channel without clear user-scoped enablement, making it easy for the skill to continuously influence agent behavior, leak sensitive action summaries aloud, or persist beyond the user's intended context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The configuration sets default_lang to "zh", which makes the skill default to Chinese output unless changed later. Under the stated policy, forcing a specific language without explicit user choice or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The helper sends announcement text to edge-tts for remote speech generation, which can expose sensitive message contents to an external service without an explicit warning or consent at the point of use. In an agent skill context, announcement text may include task data, errors, or user-provided content, making accidental data leakage more likely.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audio_announcement/announce_helper.py (reported line 260)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audio_announcement/announce_helper.py (reported line 385)May include surrounding context.

python

return False
    
    try:
        result = subprocess.run(
            player_cmd + [audio_file],
            capture_output=True,
            timeout=60

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audio_announcement/announce_helper.py (reported line 586)May include surrounding context.

python

# 3. edge-tts 可用性（快速检查）
        try:
            result = subprocess.run(
                [sys.executable, "-m", "edge_tts", "--help"],
                capture_output=True,
                timeout=5,

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · audio_announcement/scripts/announce_pygame.py (reported line 16)May include surrounding context.

python

complete: "上传完成"
    error: "网络连接失败"

详细规则见: skills/beep-skills/SKILL.md
"""

import os

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audio_announcement/scripts/announce_pygame.py (reported line 116)May include surrounding context.

python

logger.debug(f"尝试生成 ({attempt}/{MAX_RETRIES})...")
            
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The announce function hard-codes the default language parameter to "zh", which forces a specific locale unless the caller explicitly overrides it. Under the policy, locale constraints should offer user choice or require clear opt-in; this file does not indicate such opt-in at the function boundary.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · audio_announcement/scripts/announce_pygame.py (reported line 296)May include surrounding context.

python

return False
    
    try:
        result = subprocess.run(
            player_cmd + [audio_file],
            capture_output=True,
            timeout=60,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sets the default language to "zh" when the user does not provide a language argument. This imposes a specific locale by default rather than offering a neutral default or requiring explicit user choice, which is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The top-level docstring mixes English with Chinese ('小喇叭') as part of the skill description. Because this file provides no indication that multilingual output is optional or region-specific, it may conflict with a policy requiring language or locale choice rather than imposing a language implicitly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The module docstring states the helper 'falls back to shell scripts', which suggests a script-based integration path. In the actual code, audio generation uses python -m edge_tts and fallback playback directly executes system player binaries via subprocess.run, with no shell script implementation present.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · audio_announcement/announce_helper.py (reported line 162)May include surrounding context.

python

# 全局配置
_config = AnnouncementConfig.load()
setup_logging(getattr(logging, _config.log_level))

# ============ 统计与监控 ============
class StatsCollector:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · audio_announcement/announce_helper.py (reported line 527)May include surrounding context.

python

# 全局配置
_config = AnnouncementConfig.load()
setup_logging(getattr(logging, _config.log_level))

# ============ 统计与监控 ============
class StatsCollector:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring is written entirely in Chinese, which imposes a specific language for user-facing CLI documentation. Under the stated policy, locale or language should not be forced unless the tool clearly offers a choice or documents a justified regional constraint, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.