添加飞书机器人

• Analyzed: Mar 31, 2026, 2:31 AM
• Findings: 1
• Version: 1.0.0
• Hash: e25868c27e1b9ccc5c5d40abe7978455c48fba588b4a38820b9f551bfb85bd4d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides scripts for managing OpenClaw agents but contains a significant code injection vulnerability. In 'create-agent.sh' and 'delete-agent.sh', shell variables (such as agent-id and agent-name) are directly interpolated into a 'node -e' command string without sanitization. This allows an attacker to execute arbitrary JavaScript code by providing crafted input to the agent creation process. While the bundle's stated purpose of managing Feishu (Lark) agents appears legitimate and includes defensive instructions for sub-agents, the insecure handling of configuration updates poses a risk of local code execution.