feishu-english-game Security Report — Low Risk | ClawSafe

15 /100

feishu-english-game

Run a Feishu or Lark English game with lightweight group-chat interaction including vocab, guess, and speaking modes

Legitimate Feishu English game skill with clean code, declared external API usage, and only minor dependency pinning issue.

Skill Namefeishu-english-game

Duration33.5s

Enginepi

✓

Safe to install

Pin the requests library version in a requirements.txt or pyproject.toml for supply chain stability.

Findings 1 items

Severity	Finding	Location
Low	Unpinned requests dependency Supply Chain The requests library is used without version constraints, which could lead to unexpected behavior if a malicious or buggy version is installed. `import requests` → Add a requirements.txt or pin requests version in pyproject.toml, e.g., requests>=2.28.0,<3.0.0	`scripts/asr_transcribe.py:12`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`READ`	`READ`	✓ Aligned	asr_transcribe.py:73 - os.path.isfile() for validation
Network	`READ`	`READ`	✓ Aligned	asr_transcribe.py:80 - requests.post() to senseaudio.cn
Shell	`NONE`	`NONE`	—	No shell access observed

1 findings

🔗

Medium External URL 外部 URL

https://api.senseaudio.cn

SKILL.md:222

7 files · 14.9 KB · 572 lines

Markdown 4f · 391L Python 2f · 178L YAML 1f · 3L

├─ ▾ 📁 agents

│ └─ 📋 openai.yaml YAML 3L · 186 B

├─ ▾ 📁 references

│ ├─ 📝 asr_provider_notes.md Markdown 32L · 802 B

│ ├─ 📝 integration_cn.md Markdown 82L · 1.6 KB

│ └─ 📝 modes_cn.md Markdown 46L · 884 B

├─ ▾ 📁 scripts

│ ├─ 🐍 asr_transcribe.py Python 100L · 2.9 KB

│ └─ 🐍 english_game.py Python 78L · 2.1 KB

└─ 📝 SKILL.md Markdown 231L · 6.4 KB

Package	Version	Source	Known Vulns	Notes
`requests`	`*`	pip	No	Version not pinned

✓ All external network access (senseaudio.cn) is declared in SKILL.md

✓ API key usage is limited to legitimate service authentication

✓ No credential exfiltration or data theft behavior

✓ No obfuscation techniques (base64, eval, etc.)

✓ No sensitive file access beyond audio file validation

✓ Clean, readable code with proper error handling

✓ No hidden functionality - documentation matches implementation

✓ Audio files are validated with os.path.isfile() before processing