feishu-edge-tts-win

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it handles Feishu credentials in a way that can expose a bearer token locally and should be reviewed before use.

Review this skill before installing. Use only a least-privilege Feishu app credential, avoid sending sensitive text unless you accept transmission to Microsoft Edge TTS and Feishu, and prefer a revised version that uploads with an in-process HTTPS client and pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-41
Vulnerability Type: Unpinned runtime dependency
Risk Level: Medium

Vulnerable Code:

bash

pip install edge-tts

Technical Analysis

The installation instructions retrieve the latest available version of edge-tts without a version constraint or cryptographic integrity hash. Consequently, the code installed and executed by users can change after this Skill has been reviewed.

This does not demonstrate that the current edge-tts package is malicious. However, it creates a supply-chain exposure: compromise of the package publisher account, package repository, distribution artifact, or a future upstream release could introduce unreviewed executable code. Package installation and subsequent import occur with the privileges of the user running the Skill.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or its distribution channel.
2. The attacker publishes a malicious or compromised release under the expected package name.
3. A user follows the documented pip install edge-tts instruction without a version or hash constraint.
4. pip downloads and installs the attacker-controlled release.
5. Malicious package behavior executes during installation or when edge_tts is imported and used by scripts/send_voice.py.
6. The malicious code can access data and resources available to the Skill process.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running the installation or Skill. This could expose text supplied for speech generation, accessible local files, environment data, and credentials readable by that user, including the OpenClaw configuration if accessible. The scope is limited by the privileges and operating-system access controls of the affected user account.

Remediation

View remediation

Remediation Suggestions

• Pin edge-tts to a specifically reviewed version in a committed requirements file.
• Record and verify distribution hashes using pip's --require-hashes option.
• Install packages only from the official, explicitly configured package index.
• Review dependency updates before changing the pinned version.
• Consider using an isolated virtual environment with only the permissions required to generate audio.
• Document a reproducible installation command, for example:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Include hashes for every direct and transitive dependency represented in the lock file.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_voice.py:37

Finding

Feishu Tenant Access Token Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/send_voice.py, lines 37-56
Vulnerability Type: Sensitive bearer token exposure
Risk Level: Medium

Vulnerable Code:

python

def upload_file(token: str, opus_path: str) -> str:
    # Use curl for multipart upload.
    result = subprocess.run(
        [
            "curl",
            "-s",
            "-X",
            "POST",
            f"{FEISHU_API}/im/v1/files",
            "-H",
            f"Authorization: Bearer {token}",
            "-F",
            "file_type=opus",
            "-F",
            "file_name=voice.opus",
            "-F",
            f"file=@{opus_path}",
        ],
        capture_output=True,
        text=True,
        check=True,
    )
    payload = json.loads(result.stdout)
    return payload["data"]["file_key"]

Technical Analysis

The Feishu tenant access token is interpolated directly into the curl command-line argument list. Although subprocess.run uses an argument array and therefore avoids shell-command injection, the sensitive token becomes part of the child process's command line.

Depending on operating-system process-inspection permissions and local monitoring configuration, command-line arguments may be observable by other local users, privileged processes, endpoint monitoring products, diagnostic tools, or process logging systems while curl is running. The token may also be retained in telemetry or process audit logs.

Authentication with Feishu is necessary for the declared functionality, but exposing the resulting bearer token through a separate process's arguments is not necessary and exceeds minimum-risk credential handling.

Attack Path

1. The Skill reads the Feishu application credentials from the selected OpenClaw configuration.
2. It exchanges those credentials with Feishu for a tenant access token.
3. During audio upload, the Skill launches curl with ...[truncated 991 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the curl subprocess with an in-process HTTPS client supporting multipart form uploads.
• Supply the bearer token only as an HTTP header held in process memory, rather than as a child-process argument.
• Use a maintained client library with TLS certificate verification enabled.
• Apply least-privilege Feishu scopes to the application so a leaked token has limited capabilities.
• Avoid logging request headers, tokens, application secrets, or full API error objects that might contain sensitive values.
• If an external client is unavoidable, pass sensitive configuration through a protected mechanism that does not expose it in process arguments, and securely delete any temporary credential material immediately afterward.
• Rotate or invalidate potentially exposed tokens and review process-monitoring logs for accidental credential retention.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation describes capabilities that read local configuration files, invoke shell-accessible tools like ffmpeg, and communicate with external services, but it declares no explicit tool scope or permissions. This weakens reviewability and least-privilege controls, making it easier for a user or agent to run a skill with broader access than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user-provided text to external services for synthesis and uploads generated audio to Feishu using credentials from a local config file, but the documentation does not clearly warn users that message content and secrets are involved in third-party transmission. Users may unknowingly expose sensitive text or use high-privilege credentials without understanding the data flow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_voice.py (reported line 39)May include surrounding context.

python

def upload_file(token: str, opus_path: str) -> str:
    # Use curl for multipart upload.
    result = subprocess.run(
        [
            "curl",
            "-s",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The stated purpose is TTS generation and Feishu voice-message sending, but the code achieves this by spawning subprocesses for curl and ffmpeg. Process execution is a materially broader capability than the manifest description communicates, especially because it depends on arbitrary local binaries rather than only Python libraries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends arbitrary user-provided text to Microsoft's Edge TTS service for synthesis, which means message content leaves the local environment and is disclosed to a third party. For a messaging skill, this is contextually relevant and could expose sensitive or confidential content if users assume processing is local.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/send_voice.py (reported line 121)May include surrounding context.

python

print(f"Generating speech ({args.voice})...")
        asyncio.run(tts_to_mp3(args.text, args.voice, mp3_path))

        subprocess.run(
            ["ffmpeg", "-i", mp3_path, "-c:a", "libopus", opus_path, "-y"],
            capture_output=True,
            check=True,

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states '仅使用：zh-CN-XiaoxiaoNeural', which imposes a specific Chinese locale/voice with no opt-in or explanation of why only that language setting is allowed. Under the language/locale policy, forcing a specific locale without user choice or clear justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script defaults to zh-CN-XiaoxiaoNeural, which imposes a Chinese locale/voice selection unless the user explicitly overrides it. This is a natural-language policy concern because the tool chooses a specific language/locale by default without offering an initial opt-in or neutral default behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a Windows skill that generates speech with Edge TTS and sends it as a Feishu voice bubble. While interacting with Feishu is expected, this implementation also reaches into a specific local config location and later extracts appId/appSecret from that file, which is an additional credential-access capability not mentioned in the stated scope.

Content

No source excerpt is available for this finding.