添加飞书机器人

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

This skill is an OpenClaw agent management helper, but it has unsafe admin scripts that can expose secrets, delete unintended directories, inject commands, and silently bind new agents to a fixed Feishu group.

Review this skill carefully before installing. Use it only in a controlled OpenClaw admin environment, do not pass real Feishu secrets on the command line, validate or patch agent-id handling before deletion, remove or parameterize the hard-coded Feishu group binding, and avoid putting untrusted text into agent names or descriptions until the scripts escape and validate inputs safely.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: create-agent.sh:105

Finding

Arbitrary JavaScript and OS Command Execution Through Argument Injection

Content

View full analysis

a.id !== agentId); // Remove feishu account delete config.channels.feishu.accounts[agentId]; // Remove binding config.bindings = config.bindings.filter(b => b.agentId !== agentId); // Remove from agentToAgent allow list if (config.tools.agentToAgent && config.tools.agentToAgent.allow) { config.tool ...[truncated 2034 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: delete-agent.sh:21

Finding

Path Traversal Permits Directory Creation and Recursive Deletion Outside Agent Roots

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: create-agent.sh:45

Finding

Untrusted Description Is Persisted as Startup-Loaded Agent Instructions

Content

View full analysis

"$WORKSPACE_DIR/AGENTS.md" << 'AGENTEOF' # AGENTS.md - Your Workspace This folder is home. Treat it that way. ## Session Startup Before doing anything else: 1. Read `SOUL.md` — this is who you are 2. Read `USER.md` — this is who you're helping ## Memory You wake up fresh each session. These files are your continuity: - **Daily notes:** `memory/YYYY-MM-DD.md` — raw logs of what happened - **Long-term:** `MEMORY.md` — your curated memories ## Red Lines - Don't exfiltrate private data. Ever. - Don't run destructive commands without asking. AGENTEOF ``` Untrusted arguments are then embedded directly in that file: ```bash cat > "$WORKSPACE_DIR/SOUL.md" << SOULEOF # SOUL.md - Who You Are ## Identity **Name:** $AGENT_NAME **Role:** $DESCRIPTION ## Core Truths **Be genuinely helpful, not performatively helpful.** Skip the "Great question!" and "I'd be happy to help!" — just help. **Have opinions.** You're allowed to disagree, prefer things, find stuff amusing or boring. **Be resourceful before asking.** Try to figure it out. Read the file. Check the context. Search for it. ## Boundaries - Private things stay private. Period. - When in doubt, ask before acting externally. SOULEOF ``` ### Technical Analysis `AGENT_NAME` and `DESCRIPTION` are inserted without validation or escaping into `SOUL.md`. The unquoted heredoc deliberately performs parameter expansion and permits multiline values to introduce new Markdown headings, rules, and operational directives. The generated `AGENTS.md` instructs the agent to read `SOUL.md` before doing anything else. Consequently, attacker-controlled description content becomes persistent startup context rather than passive profile data. It remains active ...[truncated 1185 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: create-agent.sh:2

Finding

Feishu Application Secret Is Exposed Through Command-Line Arguments and Weak File-Handling Controls

Content

View full analysis

[model] [description] set -e AGENT_ID="$1" AGENT_NAME="$2" APP_ID="$3" APP_SECRET="$4" ``` The documentation instructs users to place the secret directly in a command: ```bash ./create-agent.sh [model] [description] ``` ```bash ./create-agent.sh xiaokefu 小客服 cli_a94xxx mysecret123 glm-5 "客服助手，帮助用户解答问题" ``` The secret is stored in the main configuration: ```bash const appSecret = '$APP_SECRET'; // Add feishu account config.channels.feishu.accounts[agentId] = { appId: appId, appSecret: appSecret, domain: 'feishu', enabled: true }; // Write back fs.writeFileSync(configPath, JSON.stringify(config, null, 2)); ``` ### Technical Analysis Command-line arguments can be recorded in shell history and may be visible through local process inspection while the command is running. The documented usage actively encourages this insecure transport mechanism. The script then stores the secret in plaintext inside `openclaw.json`. It does not verify or enforce restrictive permissions, ownership, or secure storage. `fs.writeFileSync` rewrites the configuration directly rather than using a protected atomic temporary file and an explicit secure mode. The code does not directly transmit the secret to an external destination, but it increases exposure to local users, process-monitoring systems, command logging, backups, and any application that can read the configuration. ### Attack Path 1. An operator follows the documentation and enters the Feishu secret as a positional argument. 2. The command, including ...[truncated 1025 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: create-agent.sh:135

Finding

Every New Agent Is Silently Bound to a Hard-Coded Feishu Group

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation instructs users to pass sensitive credentials such as app-secret directly on the command line and even includes a literal secret-like example. Command-line secrets can be exposed through shell history, process listings, logs, screenshots, and transcripts, making credential leakage likely in normal use.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script passes user-controlled AGENT_ID into a recursive deletion path and only checks that the resulting path exists, without validating that AGENT_ID is a safe identifier or canonicalizing the target. An attacker supplying path traversal such as '../' can make the existence check succeed on directories outside the intended agent scope and cause rm -rf to delete arbitrary directories accessible to the script.

Content

Scanner excerpt · delete-agent.sh (reported line 62)May include surrounding context.

sh

# Remove directories
echo "🗑️  删除目录..."
rm -rf "$AGENTS_DIR/$AGENT_ID"
rm -rf "$WORKSPACE_BASE/workspace-$AGENT_ID"

echo "🎉 Agent '$AGENT_ID' 已删除"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The workspace deletion path is also derived directly from untrusted AGENT_ID and is vulnerable to traversal or path-manipulation effects. Because the script is explicitly designed to destroy data, weak input validation makes the skill context more dangerous: misuse turns intended cleanup into arbitrary filesystem deletion.

Content

Scanner excerpt · delete-agent.sh (reported line 63)May include surrounding context.

sh

# Remove directories
echo "🗑️  删除目录..."
rm -rf "$AGENTS_DIR/$AGENT_ID"
rm -rf "$WORKSPACE_BASE/workspace-$AGENT_ID"

echo "🎉 Agent '$AGENT_ID' 已删除"
echo "⚠️  请执行 openclaw gateway restart 使更改生效"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to overlap with ordinary user requests about creating, deleting, or listing agents, which can cause the skill to activate unintentionally. In a skill that performs administrative actions on agent instances, accidental activation increases the risk of unauthorized or mistaken state-changing operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill supports deleting agents and restarting the gateway, both of which modify system state and can disrupt service, but it provides only minimal caution. Without explicit safeguards such as confirmation, authorization, backup guidance, or rollback steps, an operator or triggered agent could cause outages or destructive changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · create-agent.sh (reported line 67)May include surrounding context.

sh

## Red Lines

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
AGENTEOF

cat > "$WORKSPACE_DIR/SOUL.md" << SOULEOF

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persists APP_SECRET into /home/admin/.openclaw/openclaw.json without any warning, minimization, or permission hardening. Storing long-lived credentials in a plaintext config file increases the risk of credential disclosure through local file access, backups, logs, or accidental sharing, which could let an attacker impersonate the Feishu app or access related integrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

整个技能文档从标题到操作说明均固定为中文，未表明这是面向特定中文环境的限定技能，也没有给用户提供语言选择或切换说明。根据语言/locale 政策，若技能强制特定语言而无用户选择或明确地域合理性，可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script's user-visible status and usage messages are presented in Chinese, and the file provides no indication that this locale is optional or intentionally region-scoped. That can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment in the generated HEARTBEAT.md states 'Keep this file empty to skip heartbeat API calls,' which communicates an intent that the file should be empty. However, the script always populates HEARTBEAT.md with that explanatory text, so the resulting file is not empty and does not match the documented condition.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's prompts and status messages are presented in Chinese, including error, confirmation, and success output. For a general-purpose deletion script, this imposes a specific language on users without opt-in or any documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The user-facing strings printed by the script are entirely in Chinese, including the title, column headers, totals, and usage hints. This imposes a specific language on all users without opt-in or justification, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.