ClawHub
Back to skill

Security audit

Agent + Feishu Onboarding

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed operational runbook for creating OpenClaw agents and Feishu routing bindings, with confirmation and validation steps before local config changes.

Install only if you want an agent to help modify local OpenClaw agent and Feishu routing configuration. Review the final agent details, peer.id, accountId, and binding snapshot before approving any write because mistakes can route Feishu conversations to the wrong agent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims it will create agents, apply Feishu bindings, enforce multi-step confirmations, validate, and support rollback, but the file only contains procedural instructions rather than enforceable implementation. This mismatch is dangerous because operators may trust the advertised safeguards and assume writes, confirmations, and rollback protections are being enforced when they are not, leading to unsafe configuration changes or incomplete onboarding.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs reading local configuration files and environment-derived paths (openclaw.json / OPENCLAW_CONFIG_PATH) and performing operational commands, but it does not declare any explicit tool scope or permissions. In agent systems, missing scope declarations can lead to overbroad access or execution under defaults that are less restrictive than intended, increasing the blast radius if the skill is invoked in a sensitive environment.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
- Before write, print the final binding object and require explicit confirmation.

## Multi-Step Confirmation Protocol
Do not skip confirmations. Ask and confirm in this exact order.

1. Confirmation A: Agent Goal
   - Confirm what this agent should do.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

该文件标题明确标注“中文流程”，且全文操作说明均以中文固定呈现，没有说明这是可选语言或仅适用于特定中文用户群。按照语言/locale 政策，若技能强制特定语言而未提供用户选择，属于自然语言层面的策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.