ClawHub
Back to skill

Security audit

feishu voice reply

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-related but needs review because it can silently send voice messages and user text to external services while making inconsistent privacy and safety claims.

Review before installing. Do not use this skill with secrets, regulated data, or sensitive business messages unless you accept that text/audio may pass through Microsoft Edge TTS, OpenClaw Gateway, and Feishu. Prefer a pinned dependency in an isolated environment, run the installer from the skill directory only, and require explicit confirmation or tighter trigger rules before allowing it to send voice messages.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
INSTALL.sh:23
Finding

Unpinned Dependency Installed from a Third-Party Package Mirror

Content
View full analysis

Vulnerability Details

File Location: INSTALL.sh:23; also documented in SKILL.md:59-62, SKILL.md:175-177, and README.md:18
Vulnerability Type: Uncontrolled third-party dependency resolution
Risk Level: Medium

Vulnerable Code:

bash
# Install edge-tts
echo "📦 Installing edge-tts..."
pip3 install edge-tts -i https://pypi.tuna.tsinghua.edu.cn/simple

Technical Analysis

The installation script retrieves edge-tts without specifying a reviewed version or validating package hashes. Consequently, the installed code depends on whichever release the configured package index resolves at installation time.

The executable installer defaults to the Tsinghua package mirror, although other project documentation describes the dependency as coming from official PyPI. A package mirror is not inherently malicious, but using an unpinned package from any mutable index expands the supply-chain trust boundary. A compromised upstream release, compromised mirror, or unexpectedly incompatible future version could change the code installed after this Skill has been audited.

The script subsequently imports the installed package:

bash
python3 -c "import edge_tts; print('   ✅ edge-tts installed successfully')"

Python module-level code executes during import. Therefore, malicious code introduced into a resolved package release would execute with the permissions of the user running the installer.

Attack Path

  1. An attacker compromises the upstream edge-tts distribution channel, an applicable package release, or the configured mirror.
  2. The attacker publishes or serves a modified package version containing malicious module-level code.
  3. A user runs INSTALL.sh.
  4. Because no version or hash is enforced, pip resolves and installs the attacker-controlled release.
  5. The installer runs import edge_tts, executing its module-level code.
  6. The malicious dependency can access resources ava ...[truncated 618 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin edge-tts to a specific version reviewed and tested by the project:
    bash
    python3 -m pip install 'edge-tts==REVIEWED_VERSION' --index-url https://pypi.org/simple
  2. Maintain a requirements or lock file containing cryptographic hashes, and install with hash verification:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  3. Use official PyPI as the default index. If mirrors are supported, require users to opt into them explicitly and document the additional trust boundary.
  4. Use python3 -m pip rather than an independently resolved pip3 executable to ensure the dependency is installed into the same interpreter used by the Skill.
  5. Review dependency updates before changing the pinned version, and use automated dependency scanning to identify known vulnerabilities.
  6. Prefer an isolated virtual environment instead of modifying the caller's global Python environment.

T07 · Tool Hijacking and Spoofing

Warning
Location
INSTALL.sh:34
Finding

Installer Executes and Deletes Working-Directory-Relative Files

Content
View full analysis

Vulnerability Details

File Location: INSTALL.sh:34-38
Vulnerability Type: Untrusted path resolution and unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code:

bash
# Test speech generation
echo "🎙️  Testing speech generation..."
python3 edge_tts_async.py "测试" xiaoxiao test-voice.mp3

if [ -f "test-voice.mp3" ]; then
    echo "   ✅ Speech generation test succeeded"
    rm -f test-voice.mp3
else
    echo "❌ Speech generation test failed"
    exit 1
fi

Technical Analysis

The installer assumes that its current working directory is the Skill directory, but it never changes to or resolves the directory containing INSTALL.sh.

The relative path edge_tts_async.py is consequently resolved against the caller's current working directory. If the installer is launched by absolute or relative path while the caller is in another directory, Python may execute a different file named edge_tts_async.py. In a directory writable by an attacker, this permits local script substitution.

The test output is also written to the fixed relative name test-voice.mp3. If that file already exists in the caller's directory, the TTS operation may overwrite it, and the subsequent rm -f test-voice.mp3 removes it. This is a predictable, non-exclusive temporary filename and contradicts the documentation's assertion that all file operations remain inside the Skill directory.

Attack Path

  1. An attacker places a malicious file named edge_tts_async.py in a directory from which the victim is likely to launch the installer, or otherwise convinces the victim to run the installer while that directory is current.
  2. The victim executes /path/to/skill/INSTALL.sh without first changing into the Skill directory.
  3. The shell evaluates python3 edge_tts_async.py ... relative to the current directory.
  4. Python executes the attacker's script with the victim's privileges.
  5. Independently, if ` ...[truncated 658 chars]
Remediation
View remediation

Remediation Suggestions

  1. Resolve and use the directory containing the installer:
    bash
    SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
python3 "$SCRIPT_DIR/edge_tts_async.py" "test" xiaoxiao "$TEMP_DIR/test-voice.mp3"
  2. Create an exclusive temporary directory and clean it through a trap:
    bash
    TEMP_DIR=$(mktemp -d)
trap 'rm -rf -- "$TEMP_DIR"' EXIT HUP INT TERM
  3. Quote every expanded path and use -- for commands that support it to prevent path values from being interpreted as options.
  4. Do not use a predictable test filename in the caller's directory.
  5. Verify that the resolved Python script is a regular file inside the expected Skill directory before executing it.
  6. Optionally change into the Skill directory at startup, while still using an isolated temporary directory for generated test data:
    bash
    cd -- "$SCRIPT_DIR"

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description claims a complete Feishu voice auto-reply skill that generates speech and sends it via the Feishu API. However, the supplied code chunk does not implement Feishu messaging, API calls, reply automation, or any trigger logic. It only installs and validates the edge-tts dependency and tests local audio generation. While this is related to the TTS portion of the description, it does not match the declared primary purpose of automatic Feishu voice reply behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says this is a Feishu voice message auto-reply skill that generates speech with Edge TTS and sends it via the Feishu API. The provided code only covers the Edge TTS portion: it accepts command-line arguments, generates speech, and saves it to an MP3 file. There is no Feishu SDK/API usage, no receiving or replying to Feishu messages, no trigger handling, and no automation logic. While the TTS technology matches part of the description, the main claimed behavior—automatic Feishu voice reply delivery—is absent, so this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation claims the skill does not access external servers, but Edge TTS necessarily sends text to a remote provider for synthesis. This can cause sensitive message content to be exfiltrated to a third party under false privacy assurances, increasing the risk of accidental disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The installer performs a network package installation from a third-party mirror during setup without explicit user consent, integrity verification, or version pinning. This creates a supply-chain risk: if the mirror serves a tampered package or unexpected version, running the installer could introduce malicious code or break the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README highlights convenience features like 'completely free' and 'silent sending' but does not clearly warn that input text is processed by Microsoft's Edge TTS service and that generated content is then transmitted through Feishu. This can mislead users about data flow and privacy boundaries, increasing the risk of sensitive information being sent to third parties without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are generic natural-language requests and the README does not document any scope controls, confirmation step, sender restrictions, or channel constraints. In a messaging skill that can automatically generate and send Feishu voice messages, broad triggers increase the chance of unintended activation, causing accidental message transmission and possible disclosure of user-provided content to external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill does not clearly warn that message text is sent to an external TTS provider, creating a transparency and privacy risk. Users may provide sensitive business or personal content believing processing is local, leading to unintended third-party disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This line asserts '不依赖未声明的凭据', but the troubleshooting section later tells users to ensure OpenClaw has configured Feishu credentials. That means credential dependence exists and should be documented consistently, especially because credentials affect trust boundaries and deployment assumptions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

clawhub install feishu-voice-reply

或手动安装

mkdir -p ~/.openclaw/workspace/skills/feishu-voice-reply

复制 SKILL.md 和相关文件到该目录

text

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Broad, loosely defined auto-trigger phrases can cause the skill to activate unexpectedly and send content externally or produce unintended voice messages. In a messaging context, ambiguous activation boundaries increase the chance of privacy leaks, spammy behavior, or user confusion about when content is being processed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
76% confidence
Finding

The supported voices section only lists Chinese voices, and the overall documentation presents the skill as operating in Chinese without any user opt-in or explanation that it is intentionally region- or language-specific. This can constitute a language/locale policy issue because the skill appears to force a specific language context by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This Python file contains natural-language descriptions and CLI messages entirely in Chinese, including the module description and usage text. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the locale restriction is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script's comments and terminal output are presented exclusively in Chinese, which imposes a language choice on users without offering an alternative. This can violate language/locale policy expectations when no user opt-in or documented region-specific constraint is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The script executes a test command that writes test-voice.mp3 and then deletes it, which is a filesystem-modifying operation. While the script says it is testing voice generation, it does not explicitly disclose that a temporary file will be created and removed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The README states that only five Chinese voices are supported, but it does not present this as an optional locale choice or explain a region-specific requirement. Under the policy, fixed language or locale constraints can be a violation unless the user can opt in or the restriction is clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing instructions and safety information exclusively in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.