Security audit

sjht-ppt-delivery

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its stated purpose, but it uses local Feishu bot credentials and uploads the selected file to Feishu.

Install only if you want a Feishu delivery workflow that uses your configured bot credentials. Use a least-privileged Feishu bot, verify the recipient open_id, and pass only the intended generated PDF or trusted file to the send helper.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill performs network actions against the Feishu Bot API but does not declare that capability in its permissions model. Undeclared network access weakens review and consent boundaries, making it easier for a skill to exfiltrate generated documents or local files without clear operator awareness.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose is a constrained HTML-to-PDF delivery pipeline, but the described behavior allows reading Feishu credentials from local configuration and sending arbitrary existing local files, not just generated PDFs. That mismatch materially expands the skill's power into generic file exfiltration and credential use, which can be abused to send sensitive local data to an external recipient.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script reads Feishu app credentials from the user's local OpenClaw configuration and immediately uses them for external API access. Even though the skill's purpose is Feishu delivery, silently harvesting local credentials increases privilege and trust assumptions, and creates a pathway for unauthorized messaging or abuse if the skill is triggered unexpectedly or modified.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Broad trigger phrases like common presentation-related requests and an ambiguous 'task completed and needs delivery' condition increase the chance of unintended activation. In a skill that sends files over the network, accidental invocation can result in documents being transmitted to Feishu without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill does not clearly warn users that it will upload files and use recipient identifiers with the Feishu Bot API. Because this skill transmits artifacts outside the local environment, missing disclosure undermines informed consent and increases the risk of inadvertent data sharing.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill accesses sensitive local Feishu credentials without any user-facing disclosure or consent step. In an agent setting, hidden use of local secrets is risky because users may not realize the skill can act with existing bot privileges on their behalf.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script uploads the specified file and sends it to a Feishu recipient without any explicit confirmation, warning, or data-classification check. In this skill context, external transmission is the core function, which makes the behavior expected, but also more dangerous because users may trigger it as part of an automated workflow and unintentionally exfiltrate sensitive documents.

Static analysis

No suspicious patterns detected.