ClawHub
Back to skill

Security audit

Feishu Notify

Security checks for vulnerabilities and agentic risk

Overview

This Feishu notification skill is mostly purpose-aligned, but it allows unconfirmed external posting and has under-scoped controls around webhook destinations and template files.

Review before installing. Use this only with trusted Feishu webhook URLs, avoid putting sensitive data in messages, require manual approval before sends, and harden or avoid custom template paths until the path validation and webhook allowlisting are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_message.py:86
Finding

Template Directory Restriction Bypass Through Unsafe Path Validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/send_message.py:143
Finding

Arbitrary Outbound Webhook Destination Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation
str: parsed = urlparse(url) if parsed.scheme != "https": raise ValueError("Webhook URL must use HTTPS") if parsed.hostname not in ALLOWED_HOSTS: raise ValueError("Webhook host is not approved") if parsed.username or parsed.password: raise ValueError("Webhook URL must not contain user information") if parsed.port not in (None, 443): raise ValueError("Unexpected webhook port") if parsed.fragment: raise ValueError("Webhook URL must not contain a fragment") return url ``` This should be supplemented with IP-address classification, controlled DNS resolution, and a redirect handler that rejects cross-origin redirects. Unit tests should cover loopback addresses, IPv6 literals, private ranges, encoded hostnames, credentials in URLs, alternate ports, DNS rebinding scenarios, and redirects to unapproved destinations. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

The skill's core function is to send messages to external Feishu webhooks, which is a legitimate feature but also an exfiltration channel. In security terms this is dangerous because any data included in the message leaves the local trust boundary and is delivered to an externally controlled endpoint identified by the configured webhook.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
### Scripts

The `scripts/send_message.py` script provides a reliable way to send messages to Feishu via webhook. This script:
- Loads webhook URLs from user's config.json file
- Supports multiple message types (text, post, interactive, image)
- Handles message templates from templates directory (with security restrictions)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly allows autonomous sending of messages to an external service without requiring a warning or confirmation. This is dangerous because any mis-trigger, prompt-injection-induced action, or misunderstanding of user intent could immediately exfiltrate sensitive content to a third-party webhook.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/api_documentation.md (reported line 20)May include surrounding context.

md
### Authentication Method

- The webhook URL contains a unique key that identifies the bot and the target group/chat
- Anyone with the webhook URL can send messages to the group
- Keep webhook URLs secure and do not share them publicly

## Message Types

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_message.py (reported line 143)May include surrounding context.

python
message: Dict[str, Any]
) -> Optional[Dict[str, Any]]:
    """
    Send message to Feishu webhook

    Args:
        webhook_url: Feishu webhook URL

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/send_message.py (reported line 207)May include surrounding context.

python
message: Dict[str, Any]
) -> Optional[Dict[str, Any]]:
    """
    Send message to Feishu webhook

    Args:
        webhook_url: Feishu webhook URL

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly performs filesystem reads of a user config file and sends data over the network, yet it declares no explicit tool scope or allowed tools. Missing capability declarations weaken policy enforcement and user visibility, making it easier for an agent to invoke external transmission behavior without clear guardrails.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

IMPORTANT: Before using this skill, you must configure your Feishu webhook URLs:

Create the configuration file at ~/.openclaw/skills/feishu-notify/config.json with the following content:

json
{

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
- Message types include: "text", "post", "interactive", "image"
- Webhook URLs are **secrets** and should be kept secure
  - Never commit `config.json` to version control
  - Set file permissions to restrict access (chmod 600 on Unix/Linux)
  - Treat webhook URLs like API keys
- Message size limit: 200KB for most message types
- Interactive cards support buttons, images, markdown, and more

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation states configuration comes only from config.json, but it also says the agent may send messages autonomously without explicit confirmation. That combination increases the risk of silent data transmission to preconfigured external endpoints, especially if user content or sensitive context is included in messages.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger guidance includes a broad natural-language phrase that could match ordinary conversation and activate the skill unintentionally. Because this skill performs external network messaging, accidental activation can result in unreviewed disclosure of user-provided or contextual data to Feishu.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api_documentation.md (reported line 43)May include surrounding context.

Example

bash
curl -X POST "https://open.feishu.cn/open-apis/bot/v2/hook/your-webhook-key" \
  -H "Content-Type: application/json" \
  -d '{
    "msg_type": "text",

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The post message format is built only under the zh_cn locale key, which forces a specific language/locale choice in the generated message structure. There is no visible option for the user to select another locale or documentation in this file justifying a China-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The button label is fixed to Chinese ("查看详情"), which imposes a specific language in user-facing output. The file provides no indication that the skill is China/Chinese-locale-specific or that users can opt into this language, which matches the locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The card text uses fixed Chinese field labels such as '任务ID', '状态', '负责人', '截止日期', and '描述'. This enforces a specific language in user-facing output without any visible opt-in, fallback, or documentation that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The template defines post content only under the "zh_cn" locale key, which forces output into a specific language/locale. The file provides no alternative locale, user opt-in, or documented reason that this skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The examples require the zh_cn locale key and later instruct users via Chinese-only product labels such as 群机器人 and 自定义机器人. This can be a language/locale policy issue because the document implicitly forces a specific locale experience without stating that the API or workflow is region-specific or offering alternatives.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.