Feishu Card JSON v2

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:46 AM UTC
• Version: 0.2.1

Overview

The skill is a coherent Feishu card-sending integration, but it exposes broad messaging authority and lets callers choose configured Feishu accounts without a clear authorization boundary.

Install only in workspaces where Feishu bot credentials are tightly scoped. Treat the tools as capable of posting or updating messages and collecting form responses, and prefer a configuration that limits which account and recipients the agent may use. Review or patch accountId handling before using this with multiple Feishu accounts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: index.ts:229

Finding

Caller-Controlled Feishu Account Selection Enables Cross-Account Messaging

Content

View full analysis

; accountId?: string; }) { const creds = resolveFeishuCredentials(cfg, params.accountId); const result = await sendCard({ ...creds, to: params.to, card: params.card }); return { ok: true, messageId: result.messageId }; } ``` The same pattern is present in the form-sending and card-update tools. ### Technical Analysis Every registered tool allows its caller to provide an arbitrary `accountId`. The resolver treats this value as a key into the global Feishu account configuration and returns the corresponding application ID and secret. No authorization rule, account allowlist, caller-to-account binding, or validation against the plugin-level configuration is applied. The plugin manifest defines an `accountId` configuration property, but the runtime implementation does not use it to constrain account selection. Consequently, any caller capable of invoking these tools can attempt to use another configured Feishu acco ...[truncated 2301 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill requires and documents use of external plugin tools that can send messages/cards to Feishu, which is a network-capable action, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke networked actions without clear least-privilege constraints, increasing the risk of unintended data exfiltration or unauthorized outbound messaging.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code hard-codes Chinese button labels ("提交", "重置") and additional Chinese placeholder strings, and the parameter descriptions present those Chinese defaults as the standard behavior. The file does not offer a language choice or document a justified locale restriction, which creates a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.ts (reported line 154)May include surrounding context.

ts

}

async function getFeishuToken(appId: string, appSecret: string): Promise<string> {
  const res = await fetch("https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ app_id: appId, app_secret: appSecret }),

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The peer dependency on @openclaw/feishu is specified as '*', which permits any version to satisfy the requirement, including vulnerable or behaviorally incompatible releases. In a security-sensitive integration that can send Feishu cards and likely relies on account-level permission enforcement, this weak version constraint increases the chance that deployments will unknowingly use an affected package.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json

"type": "module",
  "dependencies": {},
  "peerDependencies": {
    "@openclaw/feishu": "*"
  },
  "openclaw": {
    "extensions": [

Unverifiable Dependency: @openclaw/feishu has 2 known advisory(ies) (CVE-2026-62187 (OpenClaw Feishu tools could ignore per-account disablement); CVE-2026-62188 (OpenClaw Feishu permission tools could ignore per-account disablement)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest references @openclaw/feishu without pinning a version even though known advisories exist for that package involving ignored per-account disablement. Because this skill sends Feishu interactive cards and therefore depends directly on Feishu integration behavior, consuming a vulnerable version could allow messaging or permission-related actions to bypass intended account restrictions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default button labels are set to Chinese strings ("提交", "重置"), and additional user-facing placeholders later in the file are also Chinese-only. This can violate a language/locale policy when the skill is not explicitly documented as Chinese-only and does not provide user opt-in or locale selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.