Feishu Bot Manager CN

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:14 AM UTC
• Version: 1.1.0

Overview

This Feishu bot manager is purpose-related but needs Review because it can store app secrets, broaden bot access, change global OpenClaw settings, and restart the Gateway automatically.

Review before installing. Use this only in an environment where the operator is allowed to modify OpenClaw configuration and restart the Gateway. Avoid pasting production Feishu App Secrets into chat or shell history, rotate any secret already exposed this way, check ~/.openclaw backups for plaintext secrets, and verify bot DM policy and allowlists before enabling the account.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: index.js:164

Finding

Gateway Restart Is Performed Without Explicit User Confirmation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:120

Finding

Bot Accounts Default to Unrestricted Direct-Message Access

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/new-agent-governance.md:3

Finding

Bot Provisioning Injects Persistent Governance and Memory Rules into New Agents

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:199

Finding

Feishu App Secrets Are Accepted Through Command-Line Arguments and Replicated into Backups

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/validator.js:5

Finding

Implemented Input Validators Are Not Applied Before Configuration Mutation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package.json:8

Finding

Unused Floating Third-Party Dependency Expands the Supply-Chain Attack Surface

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

声明描述的是一个具备实际管理能力的技能，会执行飞书机器人账户新增、绑定路由到 Agent、以及可能创建新 Agent 工作区等操作。但提供的代码块只包含若干正则校验函数和一个 validateConfig 方法，用于检查配置对象中 channels.feishu.accounts 与 bindings 的格式和必填字段。这属于辅助性输入/配置校验逻辑，不等同于所声明的核心业务能力。虽然这些校验可能服务于该技能的实现，但就当前代码块本身来看，其实际行为与声明的主要用途存在明显落差，因此应判定为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs users to paste an App Secret into the chat workflow without any warning about credential sensitivity, secure collection channel, masking, storage policy, or redaction. In this context, the secret can grant control over a Feishu bot integration, so exposing it in conversational logs, prompts, telemetry, or operator-visible transcripts creates a real credential-compromise risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill performs side effects beyond editing Feishu bot/account bindings: it changes a global OpenClaw session setting and restarts the gateway. Those actions affect the entire platform, not just the targeted bot, so invoking this skill can unexpectedly alter unrelated agents and active sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code invokes operational CLI commands via execSync to reconfigure runtime behavior and restart the gateway. Even though the command strings are static, this grants the skill privileged operational control that exceeds the narrow purpose of bot binding, increasing blast radius and enabling service disruption or unintended platform-wide reconfiguration.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This JavaScript file contains natural-language comments and emitted error strings entirely in Chinese, including messages likely surfaced to users or operators during validation failures. Under the policy, forcing a specific language without user opt-in or documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction explicitly tells the agent to reply with the fixed Chinese phrase “收到，正在处理 XXX” before acting. This imposes a specific language behavior without offering the user a language/locale choice or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The governance file requires persistent storage of user-related information in MEMORY.md, daily logs, and USER.md, but it provides no data minimization, consent, retention, or secret-handling rules. In a bot/account management skill, these files can easily accumulate access details, behavioral profiles, or operational secrets, increasing the chance of privacy leakage or credential exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The natural-language description is only provided in Chinese ("飞书多账户机器人配置管理"), which can indicate a language-specific constraint without offering users a choice or documenting that the skill is intentionally region-specific. Under the policy, language or locale restrictions should be explicit and justified rather than implicitly imposed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"start": "node index.js"
  },
  "dependencies": {
    "readline": "^1.3.0"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:169