T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:286- Finding
Untrusted Hot-List Content Is Consumed Without Prompt-Injection Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
免费版
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it advertises, but it asks users to paste a Feishu App Secret into chat and then uses read/write access to Feishu, so it needs review before installation.
Install only after verifying the package identity and using a dedicated, least-privilege Feishu app limited to the intended Bitable. Avoid pasting App Secret into chat if OpenClaw offers a secure secret setting, and rotate the secret if it has already been shared. Review generated records before relying on hot-list-derived content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:269- Finding
Feishu Application Secret Is Collected Through Plaintext Conversation Content
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
完整使用指南_闭环流程+飞书配置.md:362- Finding
Installation Guidance Uses Mutable, Unpinned Skill Dependencies
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs users to paste an App Secret and Bitable URL directly into chat without a strong warning that these are sensitive credentials. This creates a clear credential exposure path: the secret can be logged, retained in chat history, or mishandled by downstream systems, enabling unauthorized access to the user's Feishu application and content database.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If missing, guide user through setup with the step-by-step instructions above.
Get access token:
text POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal {"app_id": "{FEISHU_APP_ID}", "app_secret": "{FEISHU_APP_SECRET}"}
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
If missing, guide user through setup with the step-by-step instructions above.
Get access token:
text POST https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal {"app_id": "{FEISHU_APP_ID}", "app_secret": "{FEISHU_APP_SECRET}"}
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document contains a plain-language instruction to disclose a Feishu App Secret to an AI assistant, which is effectively a credential collection prompt. In the context of a content-management skill, this is especially dangerous because the assistant is not naturally expected to be a trusted secret-management endpoint, increasing the risk of accidental credential leakage and unauthorized API use.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This section directly tells users to provide a sensitive API credential to the assistant without any warning, masking, or secure handling guidance. That is a true secret-handling vulnerability because users may disclose reusable credentials into an untrusted natural-language interface where storage, logging, or reuse boundaries are unclear.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes broad everyday terms such as '飞书', '热点', '内容管理', and '日历', which can cause the skill to activate in unrelated conversations. Mis-triggering is dangerous here because the skill is configured to request credentials, read/write Feishu records, and call external APIs, so accidental activation could expose sensitive workflow data or induce unintended actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow describes automatic reading from and writing to Feishu plus fetching data from third-party hotlist endpoints, but it lacks a centralized notice explaining what data leaves the platform, which external services receive requests, and what content is processed. Users may unknowingly authorize broad data access and transmission, increasing privacy and compliance risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide explicitly instructs users to paste a Feishu App Secret into OpenClaw, making the AI/chat channel a credential intake point. Even if intended for convenience, this creates unnecessary exposure of a long-lived secret to the model, platform logs, prompt history, or downstream integrations, which could enable unauthorized access to the user's Feishu app and data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description says it will automatically store topic ideas and performance metrics in Feishu and later read all stored Feishu data for monthly analysis, but it gives no warning about what data will be accessed, retained, or synchronized. This creates a privacy and over-collection risk because users may expose content plans, account metrics, or broader workspace data without informed consent or scope boundaries.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document repeatedly presents the skill as a Feishu-based content management tool, but the installation command and detail link point to a differently named Notion skill. That mismatch can mislead users into installing the wrong package, creating a supply-chain style risk where users grant permissions or trust to a skill other than the one advertised.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The suggested trigger questions are very broad and do not define clear activation boundaries, exclusions, or required confirmation before acting. In an agent setting, this can cause the skill to activate in loosely related conversations and perform data reads/writes or external lookups when the user did not intend to invoke it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill description states it will read and write 飞书 data and call multiple third-party trending APIs, but it does not clearly disclose what user data is transmitted externally, when transmissions occur, or what data retention/permission scope applies. This lack of transparency can lead users to expose account data, content metrics, or operational metadata to external services without informed consent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document advertises a '飞书内容管理中枢' skill, but the install command and linked slug point to 'notion-content-hub-cn'. This identity mismatch can mislead users into installing a different skill than the one described, creating a supply-chain style risk where users grant permissions under false expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to paste a Feishu App Secret directly into OpenClaw chat/configuration text, which encourages unsafe handling of long-lived credentials. If the OpenClaw environment logs prompts, stores chat history, exposes workspace data to other skills, or transmits inputs to external models/services, the secret could be disclosed and used to access or manipulate the user's Feishu resources.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The file presents all instructions, commands, and expected interactions exclusively in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.
- Content
Static analysis
No suspicious patterns detected.