Security audit

Voicescope Voc Deep Insight

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for VoiceScope feedback analysis, but it needs review because it uploads customer feedback and stores broad VoiceScope credentials with weak local permission controls.

Install only if you are comfortable sending the selected feedback data to VoiceScope and having results stored in your VoiceScope project. Avoid regulated or highly sensitive customer data unless your organization has approved VoiceScope for that use, and consider the local token file sensitive; log out when finished and prefer a version that uses narrower OAuth scopes and hardened credential-file permissions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: scripts/vs_api.py:601
Finding: Mandatory Promotional Output Redirects Users to an External Platform
Content: View full analysis
None: tip = PLATFORM_NEXT_STEPS.get(kind) if not tip: return _, project, open_link = _resolve_links(data) print(f"下一步（平台更强）：{tip}") if open_link != project: print(f" 直达链接（点开即定位到本次结果，未登录先登录再跳回）：{open_link}") else: print(f" 登录工作台打开这张数据表继续：{project}") ``` The helper is invoked automatically after selected result operations, including: ```python _print_platform_next_step(data, "cluster") ``` ### Technical Analysis The Skill instructions require the agent to relay promotional follow-up messaging for selected analysis types. The CLI independently enforces the same behavior by automatically appending marketing text and platform links to otherwise task-focused output. This creates a persistent output-manipulation path: loading and following the Skill changes how the agent communicates with the user, even when platform promotion is not necessary to complete the requested analysis. The behavior is transparent in the source rather than technically concealed, but it still redirects the agent's goals from reporting results toward promoting continued use of a branded external service. This issue is narrower than arbitrary prompt injection because it does not disable safety controls or execute attacker-supplied instructions. The risk is therefore assessed as low. ### Attack Path 1. A user asks the agent to perform a supported feedback analysis. 2. ...[truncated 708 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vs_api.py:56
Finding: OAuth Access and Refresh Tokens Are Stored Without Explicit Restrictive Permissions
Content: View full analysis
dict: try: return json.loads(AUTH_FILE.read_text(encoding="utf-8")) except Exception: return {} def _save_auth(data: dict) -> None: AUTH_DIR.mkdir(parents=True, exist_ok=True) AUTH_FILE.write_text(json.dumps(data, ensure_ascii=False, indent=2), encoding="utf-8") ``` The stored data includes both access and refresh tokens: ```python _save_auth( { "access_token": data["access_token"], "refresh_token": data["refresh_token"], "token_type": data.get("token_type", "Bearer"), "created_at": int(time.time()), "base_url": BASE, } ) ``` ### Technical Analysis The CLI saves reusable OAuth credentials in plaintext at `~/.voicescope/auth.json`. Neither the containing directory nor the token file is assigned an explicit restrictive permission mode. `Path.mkdir` and `Path.write_text` create filesystem objects according to the process umask. In an environment with an overly permissive umask, shared home directory, inherited directory permissions, or a pre-existing token file with weak permissions, other local users or processes may be able to read the credentials. The refresh token is particularly sensitive because it may remain useful after the access token expires. No atomic secure-file creation procedure is used, and existing file permissions are not validated or corrected. ### Attack Path 1. A user completes device authorization through the `login` command. 2. The service returns an access token and refresh token. 3. `_save_auth` writes both credentials to `~/.voicescope/auth.json`. 4. The user's umask or existing filesystem permissions permit another local account or process to read the file. 5. The attacker copies the access or refresh token. 6. The attacker authenticates to ...[truncated 736 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/vs_api.py:194
Finding: Device Authorization Requests a Wildcard Permission Scope
Content: View full analysis
int: start = _request( "POST", "/auth/device/start", { "client_name": "VoiceScope Skill", "device_name": args.device_name or platform.node() or "Local machine", "scopes": "*", }, ) ``` ### Technical Analysis The device-login flow requests `"scopes": "*"`, granting every scope recognized by the authorization server rather than a bounded set of permissions required by the documented workflows. The Skill needs operations such as identity inspection, project or taxonomy reads, table import, analysis-task creation, status polling, and result retrieval. A wildcard request is not demonstrably necessary for those functions and violates the principle of least privilege. If the token is stolen, exposed through insecure local storage, logged by another component, or mishandled by the backend, the attacker receives the full permission set granted by the server. The wildcard may also automatically include capabilities introduced by the service in the future without a corresponding Skill review. ### Attack Path 1. The user runs `python scripts/vs_api.py login`. 2. The client requests all available authorization scopes. 3. The user approves the device authorization. 4. The service issues an access token and refresh token carrying the broad grant. 5. An attacker acquires a token through local credential-file exposure, process compromise, or another credential leak. 6. The attacker invokes any API operation permitted by the wildcard grant, including capabilities unrelated to the user's original feedback-analysis request. ### Impact Assessment The exact privileges depend on server-side scope definitions and authorization enforcement. However, the token can potentially exercise all ...[truncated 431 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to read local files, write outputs, access environment variables, and make networked backend calls, but it declares no explicit tool scope or permission boundaries. That creates an over-privileged integration surface where the agent may invoke sensitive capabilities without transparent user consent or policy enforcement, especially around local auth tokens and uploaded customer data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad and can match many generic discussions about feedback, tagging, sentiment, keywords, and classification, causing the skill to activate outside a tightly bounded context. In practice this can lead to unintended file handling and transmission of user data to the VoiceScope service when the user did not clearly intend to invoke this external-processing workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that authentication, LLM calls, long-running tasks, and result persistence occur in the VoiceScope backend, but the user-facing description does not prominently warn that uploaded feedback will be transmitted off-box and stored in the user's project. This is risky because customer feedback frequently contains sensitive business or personal data, and users may consent to analysis without understanding the external disclosure and retention implications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Multiple docstrings and printed messages in this code are written in Chinese, including operational guidance and warnings, with no mechanism for users to choose their preferred language. This creates a locale policy issue because the skill does not offer language selection or clearly justify a Chinese-only audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The analyze command submits table_id/column_id and optional background knowledge to a remote VoiceScope API, but the CLI does not present an explicit user-facing notice at the point of action that data will be transmitted off-host for AI processing. In a skill specifically intended for customer-feedback/VOC analysis, this is privacy-relevant because users may provide sensitive comments, complaints, or survey text containing personal or confidential business data and may not realize it is being uploaded to a third-party service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.