Feishu Group Company

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:09 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Feishu routing purpose, but it persistently changes OpenClaw group access policy to open without documenting that side effect.

Review this skill before installing or running it. It is not evidence of malware, but administrators should understand that running the script can persistently open the configured Feishu group policy in OpenClaw; use dry-run, take a backup, and verify whether groupPolicy: open is intended for the target group.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/apply_feishu_group_company.py:33

Finding

Undisclosed Access-Policy Relaxation

Content

View full analysis

Vulnerability Details

File Location: scripts/apply_feishu_group_company.py, lines 33 and 47
Vulnerability Type: Unauthorized access and privilege escalation
Risk Level: Medium

Vulnerable Code

python

top_group['requireMention'] = True
top_group['groupPolicy'] = 'open'

The same policy is also applied to every patched account:

python

entry['requireMention'] = require_mention
entry['groupPolicy'] = 'open'

Technical Analysis

The script unconditionally assigns groupPolicy the value open at both the top-level group configuration and each patched account's group configuration. Existing restrictive policy values are overwritten without operator confirmation.

The documented purpose of the skill is to configure mention-based routing among a coordinator and specialist bots. The access-policy relaxation is not identified among the changes documented in SKILL.md, and it is not inherently necessary merely to set requireMention. Consequently, running the script against an existing restricted deployment can silently broaden access beyond the task's stated routing objective.

The effective severity depends on OpenClaw's precise groupPolicy semantics and any external Feishu controls. Nevertheless, forcibly replacing an existing restrictive policy with open violates least privilege and creates a credible access-control risk.

Attack Path

1. An OpenClaw deployment has a Feishu group configured with a restrictive group policy.
2. An administrator runs this skill's script to establish the documented coordinator and specialist mention-routing behavior.
3. During patching, the script overwrites the top-level group policy and all selected accounts' per-group policies with open.
4. The modified configuration is written to openclaw.json.
5. After the configuration is loaded, group participants who were not authorized under the former restrictive policy may be able to invoke the ...[truncated 966 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not change groupPolicy as part of the default mention-routing operation.
2. Preserve existing policy values when present:

   python

   top_group['requireMention'] = True
   entry['requireMention'] = require_mention
   

3. If policy initialization is necessary, use a restrictive default only when the key is absent rather than overwriting an existing value.
4. Add an explicit option such as --group-policy for operators who intentionally want to change access policy. Validate it against a strict allowlist of supported values.
5. Require an explicit confirmation flag before accepting open, particularly for non-interactive use.
6. Display old and new access-policy values during dry runs and before writing the configuration.
7. Document the policy change and its security implications in SKILL.md.
8. Validate the resulting configuration with an unauthorized test account to ensure that mention routing does not unintentionally bypass group access restrictions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs the operator to run a script that patches ~/.openclaw/openclaw.json, which implies file read/write capability, but the manifest does not declare any permissions or allowed-tools scope. This creates an authorization gap: an agent or reviewer cannot reliably tell from the skill metadata that the skill modifies local configuration, increasing the chance of over-broad or unexpected file changes being executed without informed approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CEO_PROMPT string is written entirely in Chinese and defines the agent's response behavior without offering any language or locale opt-in. This is a natural-language policy concern because it forces a specific language context for interaction logic, and the file does not document that the skill is intended only for a Chinese-language or region-specific deployment.

Content

No source excerpt is available for this finding.