Security audit

Feishu Voice (macOS)

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform its stated Feishu voice-message function, but it sends content through external services with bot credentials and has unsafe shell handling that users should review before installing.

Install only if you are comfortable letting this skill read Feishu bot credentials, send message text or generated audio to Feishu recipients, and send text to OpenAI whenever OPENAI_API_KEY is present. Prefer using it with non-sensitive content, ordinary user privileges, explicit recipient IDs, and a revised script that uses mktemp, cleanup traps, JSON serialization, and receive_id_type validation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/feishu-voice.sh:30
Finding: Predictable temporary files permit local symlink attacks and leave sensitive audio after failures
Content: View full analysis
/dev/null rm -f "$TMP_MP3" else # ── macOS say (fallback) ───────────────────────────────────── MAC_VOICE="${VOICE:-Tingting}" TMP_AIFF="/tmp/feishu-voice-$$.aiff" echo "🎙️ TTS engine: macOS say (voice=$MAC_VOICE)" say -v "$MAC_VOICE" "$TEXT" -o "$TMP_AIFF" ffmpeg -y -i "$TMP_AIFF" -acodec libopus -ac 1 -ar 16000 "$TMP_OPUS" 2>/dev/null rm -f "$TMP_AIFF" fi ``` The documentation also recommends fixed shared paths: ```bash curl -s -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{"mod ...[truncated 2440 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/feishu-voice.sh:46
Finding: Untrusted values are interpolated directly into Python source code and JSON request bodies
Content: View full analysis
&2 exit 1 fi ``` ```bash # --- Step 3: Get tenant_access_token --- TENANT_TOKEN=$(curl -sf -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # --- Step 4: Upload file --- FILE_KEY=$(curl -sf -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -F "file_type=opus" \ -F "file_name=voice.opus" \ -F "duration=$DURATION_MS" \ -F "file=@$TMP_OPUS" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['file_key'])") echo "☁️ Uploaded: $FILE_KEY" # --- Step 5: Send audio message --- RESULT=$(curl -sf -X POST \ "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}") MSG_ID=$(echo "$RESULT" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d['data']['message_id'] if d['code']==0 else 'ERROR: '+d['msg'])") ``` ### Technical Analysis `CONFIG` is inserted directly into the source string supplied to `py ...[truncated 2948 chars]
Remediation: View remediation
&2 exit 1 ;; esac ``` Also validate the expected `ou_` or `oc_` recipient prefix, use `curl --data-binary "$PAYLOAD"`, reject control characters where appropriate, and run the Skill only with ordinary user privileges. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
5. Get tenant_access_token

bash
TENANT_TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
6. Upload file

bash
FILE_KEY=$(curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -F "file_type=opus" \ -F "file_name=voice.opus" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 88)May include surrounding context.
sh
}))" "$TEXT" "$OAI_VOICE") fi curl -sf -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 116)May include surrounding context.
sh
echo "⏱️ Duration: ${DURATION_MS}ms" # --- Step 3: Get tenant_access_token --- TENANT_TOKEN=$(curl -sf -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 122)May include surrounding context.
sh
| python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])") # --- Step 4: Upload file --- FILE_KEY=$(curl -sf -X POST "https://open.feishu.cn/open-apis/im/v1/files" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -F "file_type=opus" \ -F "file_name=voice.opus" \

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 132)May include surrounding context.
sh
echo "☁️ Uploaded: $FILE_KEY" # --- Step 5: Send audio message --- RESULT=$(curl -sf -X POST \ "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -H "Content-Type: application/json" \

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documents shell-based execution and network operations but does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens containment and review because an agent may invoke shell/network capabilities more broadly than users expect when using this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger text is broad enough to activate on generic requests like 'send a voice message' or 'use voice,' which can cause the skill to run in contexts the user did not specifically intend for Feishu. Because activation can lead to external transmission of message contents to Feishu and optionally OpenAI, accidental invocation meaningfully increases privacy and misdelivery risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill description does not clearly warn that message text may be sent to OpenAI when OPENAI_API_KEY is present, creating a hidden data-sharing path. Users may believe the skill only posts to Feishu, while their content is also transmitted to a separate third-party processor for TTS.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The explicit OpenAI endpoint confirms that message contents leave the local environment and Feishu boundary for third-party processing. In context this is functional rather than malicious, but it becomes dangerous when users are not clearly informed that their text is being shared with OpenAI.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
2a. TTS → mp3 (OpenAI)

bash
curl -s -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model":"gpt-4o-mini-tts","input":"要说的文字","voice":"shimmer","response_format":"mp3"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The explicit OpenAI endpoint confirms that message contents leave the local environment and Feishu boundary for third-party processing. In context this is functional rather than malicious, but it becomes dangerous when users are not clearly informed that their text is being shared with OpenAI.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
2a. TTS → mp3 (OpenAI)

bash
curl -s -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model":"gpt-4o-mini-tts","input":"要说的文字","voice":"shimmer","response_format":"mp3"}' \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
5. Get tenant_access_token

bash
TENANT_TOKEN=$(curl -s -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
7. Send audio message

bash
curl -s -X POST "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -H "Content-Type: application/json" \ -d "{\"receive_id\":\"$RECEIVE_ID\",\"msg_type\":\"audio\",\"content\":\"{\\\"file_key\\\":\\\"$FILE_KEY\\\"}\"}"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This finding is the same underlying issue as the other OpenAI endpoint transmission finding at line 88: message text is sent to a third-party API for speech generation. The risk is confidentiality loss rather than code execution, and it is heightened by automatic use of OpenAI when an API key is present.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 88)May include surrounding context.
sh
}))" "$TEXT" "$OAI_VOICE") fi curl -sf -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: This finding is the same underlying issue as the other OpenAI endpoint transmission finding at line 88: message text is sent to a third-party API for speech generation. The risk is confidentiality loss rather than code execution, and it is heightened by automatic use of OpenAI when an API key is present.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 88)May include surrounding context.
sh
}))" "$TEXT" "$OAI_VOICE") fi curl -sf -X POST "https://api.openai.com/v1/audio/speech" \ -H "Authorization: Bearer $OPENAI_API_KEY" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 116)May include surrounding context.
sh
echo "⏱️ Duration: ${DURATION_MS}ms" # --- Step 3: Get tenant_access_token --- TENANT_TOKEN=$(curl -sf -X POST "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal" \ -H "Content-Type: application/json" \ -d "{\"app_id\":\"$APP_ID\",\"app_secret\":\"$APP_SECRET\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin)['tenant_access_token'])")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The script sends synthesized audio messages to Feishu based on arbitrary input text and recipient identifiers, creating an external data exfiltration path to chat recipients. In the context of an agent skill, this is potentially dangerous because a prompt or upstream workflow could cause unintended transmission of sensitive information to a user or group chat.
Content: Scanner excerpt · scripts/feishu-voice.sh (reported line 132)May include surrounding context.
sh
echo "☁️ Uploaded: $FILE_KEY" # --- Step 5: Send audio message --- RESULT=$(curl -sf -X POST \ "https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=$RECEIVE_ID_TYPE" \ -H "Authorization: Bearer $TENANT_TOKEN" \ -H "Content-Type: application/json" \

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The comment example suggests using a fixed regional accent ("Speak with a Taiwan Mandarin accent") as an instruction, which is a natural-language locale preference embedded in the skill. Under the policy, forcing or prescribing a specific language/locale variant without explicit user choice can be a locale-policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

5. Get tenant_access_token

External Script Fetching

6. Upload file

External Script Fetching

External Script Fetching

External Script Fetching

External Script Fetching

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

External Transmission

2a. TTS → mp3 (OpenAI)

External Transmission

2a. TTS → mp3 (OpenAI)

External Transmission

5. Get tenant_access_token

External Transmission

7. Send audio message

External Transmission

External Transmission

External Transmission

External Transmission

Natural-Language Policy Violations

Static analysis