ClawHub
Back to skill

Security audit

feishu-chat-forwarder

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated purpose of forwarding Feishu chat messages, but users should treat it as privacy-sensitive because it can send recent chat history to another recipient.

Install only if you intend to let this skill read Feishu chat history and forward it to another Feishu recipient. Before use, verify that the source chat, destination, message count, and Feishu app permissions are authorized, and protect or periodically clear the cached token file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is explicitly designed to copy recent chat history from one conversation and forward it to another user or chat, yet the description does not warn about privacy, consent, authorization, or sensitive-data exposure. In a messaging environment, this can enable unauthorized disclosure of private discussions, credentials, personal data, or confidential business information if the operator supplies an unintended or abusive source/target combination.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This script forwards messages from one chat to another solely based on command-line parameters and immediately executes the data-transfer action without any confirmation, preview, or policy check. In a skill/agent context, that increases the risk of accidental or unauthorized disclosure of potentially sensitive chat content to the wrong recipient, especially because the tool can bulk-forward recent messages.

VirusTotal

No VirusTotal findings

View on VirusTotal