Security audit

OmniVoice

Security checks for vulnerabilities and agentic risk

Overview

OmniVoice is a real voice toolkit, but it handles sensitive voice biometrics, cloud voice cloning, and Feishu message sending without enough scoping, consent, or retention safeguards.

Review this skill before installing. Use it only with voices you are authorized to store, identify, clone, or send; keep voice-refs and TOOLS.md private; avoid broad automatic activation; prefer pinned dependencies and reviewed model revisions; and treat SiliconFlow and Feishu use as external sharing of sensitive audio data and credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/voice_identify.py:91
Finding: Unpinned Python Dependencies and Mutable Model Artifacts
Content: View full analysis
Remediation: View remediation
" feature_extractor = AutoFeatureExtractor.from_pretrained( MODEL_NAME, revision=MODEL_REVISION, cache_dir=MODEL_CACHE, ) model = UniSpeechSatForXVector.from_pretrained( MODEL_NAME, revision=MODEL_REVISION, cache_dir=MODEL_CACHE, use_safetensors=True, ) ``` 4. Prefer reviewed safe-serialization model artifacts and avoid loading models that require remote custom code. 5. Record expected artifact checksums and verify them before use. 6. Use a controlled dependency mirror or prebuilt, reviewed environment for production deployment. 7. Store the model cache in a user-private directory with restrictive permissions rather than a broadly shared temporary location. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/feishu_send_audio.sh:53
Finding: Feishu Credentials and Access Token Exposed in Process Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Tainted flow: 'headers' from os.environ.get (line 58, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/cosyvoice_clone.py (reported line 101)May include surrounding context.
python
# Default voice payload["voice"] = f"{MODEL}:alex" resp = requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=120) if resp.status_code != 200: print(f"API error {resp.status_code}: {resp.text}", file=sys.stderr)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation adds Feishu messaging and credentialed API use that are outside the core declared voice-toolkit purpose. Hidden or under-declared outbound messaging capabilities are risky because they can transmit generated or user-provided audio to external recipients, creating exfiltration and abuse potential.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation adds Feishu messaging and credentialed API use that are outside the core declared voice-toolkit purpose. Hidden or under-declared outbound messaging capabilities are risky because they can transmit generated or user-provided audio to external recipients, creating exfiltration and abuse potential.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation adds Feishu messaging and credentialed API use that are outside the core declared voice-toolkit purpose. Hidden or under-declared outbound messaging capabilities are risky because they can transmit generated or user-provided audio to external recipients, creating exfiltration and abuse potential.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill lacks user-facing warnings and consent safeguards for highly privacy-sensitive actions: storing voice references, identifying speakers, and cloning voices. In this context, the omission is especially serious because voice biometrics and cloned voices can enable impersonation, surveillance, and long-term retention of sensitive personal data.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu_send_audio.sh (reported line 58)May include surrounding context.
sh
# ── Step 2: 获取 tenant_access_token ───────────────────── TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu_send_audio.sh (reported line 68)May include surrounding context.
sh
DURATION_MS=$(ffprobe -v quiet -show_entries format=duration -of csv=p=0 "$OPUS_FILE" \ | python3 -c "import sys; print(int(float(sys.stdin.read().strip())*1000))") FILE_KEY=$(curl -s -X POST 'https://open.feishu.cn/open-apis/im/v1/files' \ -H "Authorization: Bearer $TOKEN" \ -F "file_type=opus" -F "file_name=voice.opus" -F "duration=$DURATION_MS" \ -F "file=@$OPUS_FILE" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents use of shell commands, filesystem access, environment variables, and networked APIs, but it declares no explicit tool scope or permissions boundary. In a skill that handles sensitive audio and credentials, this increases the risk of over-privileged execution and makes it harder to constrain misuse or accidental data exfiltration.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes very generic terms like 'voice', 'audio', and 'transcribe', which can cause the skill to activate on broad classes of user requests. Because this skill can store voice references, identify speakers, clone voices, and send outputs externally, accidental invocation can lead to privacy-invasive processing without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The skill instructs persistent storage of voice references and metadata in workspace files, creating session-to-session retention of biometric voice data. Persistent storage of voiceprints and associated identities increases the impact of unauthorized access, misuse, and repurposing, particularly because voice data is difficult to revoke once leaked.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
1. Copy audio to `voice-refs/<name>-ref1.<ext>` 2. Transcribe to get reference text: `whisper <audio> --model small --output_format txt --output_dir /tmp` 3. Add entry to `TOOLS.md` (see format in references/) 4. Register speaker in `voice_identify.py` `SPEAKER_MAP` **Good reference audio:** 10-15s clear speech, minimal noise, natural pace. 5s minimum.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documents a Feishu voice-message sending capability that is not declared in the main manifest. Undeclared communications features are dangerous because they expand the skill from local audio processing into external transmission, which can leak sensitive content or be repurposed for unauthorized messaging.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Feishu messaging is not justified by the stated role of a voice identity toolkit and introduces an external communications channel with credential use. In context, this makes the skill more dangerous because voice data and cloned outputs are privacy-sensitive, and outbound delivery can facilitate impersonation, harassment, or data leakage.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/cosyvoice_clone.py (reported line 31)May include surrounding context.
python
] MODEL = "FunAudioLLM/CosyVoice2-0.5B" API_URL = "https://api.siliconflow.cn/v1/audio/speech" def parse_args():

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The script transmits user-provided text and potentially reference audio/voice-cloning material to an external network service. In the context of a voice identity and cloning toolkit, this is security-relevant because it can export sensitive biometric and conversational data off-device to a third party, creating privacy, compliance, and misuse risks.
Content: Scanner excerpt · scripts/cosyvoice_clone.py (reported line 101)May include surrounding context.
python
# Default voice payload["voice"] = f"{MODEL}:alex" resp = requests.post(API_URL, headers=headers, json=payload, stream=True, timeout=120) if resp.status_code != 200: print(f"API error {resp.status_code}: {resp.text}", file=sys.stderr)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: When --ref or --ref-url is used, the script sends reference voice audio and associated transcript text to a third-party API for cloning. In a voice identity/cloning skill, that data may be highly sensitive biometric information, so the lack of explicit consent, warning, or privacy disclosure materially increases the risk of unauthorized transmission and misuse.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This shell script includes its title, usage comments, and runtime error/output messages in Chinese only. For a general-purpose skill file, that is a natural-language locale restriction without user opt-in or a documented justification, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script requires Feishu application credentials, obtains an access token, uploads an audio file, and sends a message to a recipient. In a skill presented primarily as voice analysis/identity tooling, this introduces external credential use and data transmission that are not obviously necessary, raising exfiltration and unauthorized messaging concerns.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/feishu_send_audio.sh (reported line 58)May include surrounding context.
sh
# ── Step 2: 获取 tenant_access_token ───────────────────── TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"$FEISHU_APP_ID\",\"app_secret\":\"$FEISHU_APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script goes beyond local voice processing and actively sends audio-derived content to Feishu messaging APIs. That creates a capability mismatch with the advertised voice toolkit and increases the risk of covert exfiltration or unauthorized outbound communication, especially because the operation targets arbitrary recipient IDs.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This call sends an audio message to a Feishu recipient specified at runtime, enabling transmission of user-provided audio or derived content to an external party. In the context of a voice-analysis skill, that materially increases the danger because sensitive voice data can be shared externally without the feature being clearly justified by the declared purpose.
Content: Scanner excerpt · scripts/feishu_send_audio.sh (reported line 81)May include surrounding context.
sh
# ── Step 4: 发送语音消息 ───────────────────────────────── RESULT=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TOKEN" \ -H 'Content-Type: application/json' \ -d "{\"receive_id\":\"$FEISHU_RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}")

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest focuses on audio/voice tasks, but SKILL.md documents extracting audio from video files with ffmpeg. While related, video-processing support is an additional capability not stated in the manifest description or trigger list.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The code creates the output directory and writes the returned audio to a local file, but it provides no prior user-facing notice beyond the argument definition for --output. Under the stated criteria, file writes should have some form of disclosure via prompt, logging, comment, or clear skill documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: These lines invoke Hugging Face from_pretrained, which will fetch model artifacts over the network on first run. Although the top-level docstring mentions that the first run downloads a model, there is no user-facing runtime disclosure near the operation itself, and network activity may matter for privacy or environment-sensitive usage.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/voice_identify.py:87