feishu-edge-tts-win

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it handles Feishu credentials in a way that can expose a bearer token locally and should be reviewed before use.

Review this skill before installing. Use only a least-privilege Feishu app credential, avoid sending sensitive text unless you accept transmission to Microsoft Edge TTS and Feishu, and prefer a revised version that uploads with an in-process HTTPS client and pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned Third-Party Dependency Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 37-41 **Vulnerability Type**: Unpinned runtime dependency **Risk Level**: Medium **Vulnerable Code**: ```bash pip install edge-tts ``` ### Technical Analysis The installation instructions retrieve the latest available version of `edge-tts` without a version constraint or cryptographic integrity hash. Consequently, the code installed and executed by users can change after this Skill has been reviewed. This does not demonstrate that the current `edge-tts` package is malicious. However, it creates a supply-chain exposure: compromise of the package publisher account, package repository, distribution artifact, or a future upstream release could introduce unreviewed executable code. Package installation and subsequent import occur with the privileges of the user running the Skill. ### Attack Path 1. An attacker compromises the upstream package, its publisher account, or its distribution channel. 2. The attacker publishes a malicious or compromised release under the expected package name. 3. A user follows the documented `pip install edge-tts` instruction without a version or hash constraint. 4. `pip` downloads and installs the attacker-controlled release. 5. Malicious package behavior executes during installation or when `edge_tts` is imported and used by `scripts/send_voice.py`. 6. The malicious code can access data and resources available to the Skill process. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running the installation or Skill. This could expose text supplied for speech generation, accessible local files, environment data, and credentials readable by that user, including the OpenClaw configuration if accessible. The scope is limited by the privileges and operating-system access controls of the affected user account.
• Remediation: ## Remediation Suggestions - Pin `edge-tts` to a specifically reviewed version in a committed requirements file. - Record and verify distribution hashes using pip's `--require-hashes` option. - Install packages only from the official, explicitly configured package index. - Review dependency updates before changing the pinned version. - Consider using an isolated virtual environment with only the permissions required to generate audio. - Document a reproducible installation command, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Include hashes for every direct and transitive dependency represented in the lock file.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/send_voice.py:37
• Finding: Feishu Tenant Access Token Exposed Through Process Arguments## Vulnerability Details **File Location**: `scripts/send_voice.py`, lines 37-56 **Vulnerability Type**: Sensitive bearer token exposure **Risk Level**: Medium **Vulnerable Code**: ```python def upload_file(token: str, opus_path: str) -> str: # Use curl for multipart upload. result = subprocess.run( [ "curl", "-s", "-X", "POST", f"{FEISHU_API}/im/v1/files", "-H", f"Authorization: Bearer {token}", "-F", "file_type=opus", "-F", "file_name=voice.opus", "-F", f"file=@{opus_path}", ], capture_output=True, text=True, check=True, ) payload = json.loads(result.stdout) return payload["data"]["file_key"] ``` ### Technical Analysis The Feishu tenant access token is interpolated directly into the `curl` command-line argument list. Although `subprocess.run` uses an argument array and therefore avoids shell-command injection, the sensitive token becomes part of the child process's command line. Depending on operating-system process-inspection permissions and local monitoring configuration, command-line arguments may be observable by other local users, privileged processes, endpoint monitoring products, diagnostic tools, or process logging systems while `curl` is running. The token may also be retained in telemetry or process audit logs. Authentication with Feishu is necessary for the declared functionality, but exposing the resulting bearer token through a separate process's arguments is not necessary and exceeds minimum-risk credential handling. ### Attack Path 1. The Skill reads the Feishu application credentials from the selected OpenClaw configuration. 2. It exchanges those credentials with Feishu for a tenant access token. 3. During audio upload, the Skill launches `curl` with ...[truncated 991 chars]
• Remediation: ## Remediation Suggestions - Replace the `curl` subprocess with an in-process HTTPS client supporting multipart form uploads. - Supply the bearer token only as an HTTP header held in process memory, rather than as a child-process argument. - Use a maintained client library with TLS certificate verification enabled. - Apply least-privilege Feishu scopes to the application so a leaked token has limited capabilities. - Avoid logging request headers, tokens, application secrets, or full API error objects that might contain sensitive values. - If an external client is unavoidable, pass sensitive configuration through a protected mechanism that does not expose it in process arguments, and securely delete any temporary credential material immediately afterward. - Rotate or invalidate potentially exposed tokens and review process-monitoring logs for accidental credential retention.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that read local configuration files, invoke shell-accessible tools like ffmpeg, and communicate with external services, but it declares no explicit tool scope or permissions. This weakens reviewability and least-privilege controls, making it easier for a user or agent to run a skill with broader access than expected.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill sends user-provided text to external services for synthesis and uploads generated audio to Feishu using credentials from a local config file, but the documentation does not clearly warn users that message content and secrets are involved in third-party transmission. Users may unknowingly expose sensitive text or use high-privilege credentials without understanding the data flow.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def upload_file(token: str, opus_path: str) -> str:
    # Use curl for multipart upload.
    result = subprocess.run(
        [
            "curl",
            "-s",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The stated purpose is TTS generation and Feishu voice-message sending, but the code achieves this by spawning subprocesses for curl and ffmpeg. Process execution is a materially broader capability than the manifest description communicates, especially because it depends on arbitrary local binaries rather than only Python libraries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script sends arbitrary user-provided text to Microsoft's Edge TTS service for synthesis, which means message content leaves the local environment and is disclosed to a third party. For a messaging skill, this is contextually relevant and could expose sensitive or confidential content if users assume processing is local.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Generating speech ({args.voice})...")
        asyncio.run(tts_to_mp3(args.text, args.voice, mp3_path))

        subprocess.run(
            ["ffmpeg", "-i", mp3_path, "-c:a", "libopus", opus_path, "-y"],
            capture_output=True,
            check=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The documentation states '仅使用：zh-CN-XiaoxiaoNeural', which imposes a specific Chinese locale/voice with no opt-in or explanation of why only that language setting is allowed. Under the language/locale policy, forcing a specific locale without user choice or clear justification is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The script defaults to `zh-CN-XiaoxiaoNeural`, which imposes a Chinese locale/voice selection unless the user explicitly overrides it. This is a natural-language policy concern because the tool chooses a specific language/locale by default without offering an initial opt-in or neutral default behavior.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest describes a Windows skill that generates speech with Edge TTS and sends it as a Feishu voice bubble. While interacting with Feishu is expected, this implementation also reaches into a specific local config location and later extracts appId/appSecret from that file, which is an additional credential-access capability not mentioned in the stated scope.

Static analysis

No suspicious patterns detected.