Feishu Group Thread Reply

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill is transparent about changing Feishu/OpenClaw reply behavior, but it directly edits installed OpenClaw plugin and skill code without backup, rollback, or strong patch validation safeguards.

Review this before installing if the OpenClaw instance is important or shared. Run the check-only commands first, make your own backup of the target OpenClaw files, and avoid the heartbeat auto-reapply guidance unless you are comfortable maintaining local patches that may break after upstream updates.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/patch-live-card.py:31

Finding

Unscoped Source Transformation Can Corrupt the Target Watcher

Content

View full analysis

Vulnerability Details

File Location: scripts/patch-live-card.py, lines 31–41
Vulnerability Type: Unscoped source-code replacement
Risk Level: Medium

Vulnerable Code

python

def apply_patch(content: str) -> str:
    """Apply the patch to watcher.py content."""
    # Patch signature
    content = content.replace(OLD_SIGNATURE, NEW_SIGNATURE)
    # Patch body - add reply_in_thread to the request body
    # Only add if not already present
    if '"reply_in_thread": reply_in_thread' not in content:
        content = content.replace(
            OLD_BODY_MARKER,
            NEW_BODY_LINES,
        )
    return content

Technical Analysis

The patcher uses unrestricted str.replace() operations across the complete target file. In particular, every occurrence of:

python

"content": json.dumps(card),

is replaced, rather than only the occurrence inside the expected reply_card() method.

The body replacement can also proceed when OLD_SIGNATURE was not found. If the target watcher has changed between versions but still contains OLD_BODY_MARKER, the script can insert:

python

"reply_in_thread": reply_in_thread,

into unrelated methods where reply_in_thread is undefined. The script verifies only that the resulting text differs before writing it; it does not validate match counts, method scope, or Python syntax.

The optional --watcher-path argument allows the user to select another file, increasing the scope of accidental modification, although exploitation still requires the patch script to be invoked against that file.

Attack Path

1. A modified, incompatible, or newer watcher.py contains one or more occurrences of "content": json.dumps(card),.
2. Its expected reply_card() signature is absent or has changed.
3. The user runs python3 scripts/patch-live-card.py, potentially following the documented installation procedure.
4. The signature replacement makes no change, but the global body-marker replacem ...[truncated 917 chars]

Remediation

View remediation

Remediation Suggestions

1. Require the expected method signature to occur exactly once before attempting any modification.
2. Scope the body-marker replacement to the body of reply_card() rather than applying it to the entire file.
3. Require exactly one body-marker match in the intended method and abort on zero or multiple matches.
4. Parse the target with Python's ast module or use a syntax-aware transformation instead of unrestricted string replacement.
5. Create a backup before modification and perform the update atomically using a temporary file followed by os.replace().
6. Validate the patched output with ast.parse() before writing it.
7. Confirm after transformation that the new parameter and request-body field occur in the same intended method.
8. Preserve original file permissions and provide a clear error without modifying the target when its structure is unsupported.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented purpose says the skill patches the broader OpenClaw/Lark reply path, but the observed behavior appears narrower and inconsistent with that claim. This mismatch is dangerous because operators may trust the skill to change one component while it actually modifies another, leading to unintended code changes, incomplete remediation, or blind execution of scripts under false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs users to run local patching scripts that read and modify installed files, but it declares no tool scope or permissions metadata. That omission reduces transparency and prevents policy-based restriction of file-modifying behavior, which is risky because this skill edits plugin code and influences operational state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells users to patch installed plugin files and restart the gateway without any warning, backup guidance, rollback procedure, or confirmation step. Modifying vendor-managed files and restarting services can cause outages, break future updates, or leave systems in an unknown state, especially since npm updates overwrite the changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.