ClawHub
Back to skill

Security audit

Feishu Image

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it can upload any readable local file or fetched URL content to Feishu without enough scoping or safety checks.

Review before installing. Use only with trusted image paths, trusted URLs, and verified Feishu recipients. Do not let untrusted prompts choose --file, --image, --url, or --target values. Keep FEISHU_APP_SECRET out of source control and logs. Prefer adding image type validation, file-size limits, HTTPS-only URL handling, private-network blocking, timeouts, and clearer install dependencies before routine use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
send.js:36
Finding

Unrestricted Local File Read and Upload to Feishu

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
send.js:15
Finding

Server-Side Request Forgery Through Unrestricted Image URL Download

Content
View full analysis
{ protocol.get(url, function(response) { response.pipe(file); file.on('finish', function() { file.close(() => resolve(tempFile)); }); }).on('error', function(err) { fs.unlink(tempFile, () => {}); reject(err); }); }); } ``` The URL is passed directly from the command-line option to the downloader: ```js if (options.url) { try { console.log(`Downloading image from ${options.url}...`); tempFile = await downloadImage(options.url); filePath = tempFile; } catch (e) { console.error('Error downloading image:', e.message); process.exit(1); } } ``` ### Technical Analysis The `--url` option permits the caller to make the Skill host request an arbitrary network location. The implementation does not securely parse or validate: - URL scheme - Destination hostname - Resolved IP address - Destination port - Loopback, private, link-local, multicast, or cloud metadata ranges - HTTP response status - Response MIME type or file signature - Response length - Request and download timeout Plaintext HTTP is allowed. A caller can therefore direct the Skill toward services reachable from the host but not directly reachable by the caller. Potential destinations include loopback services, private network services, and cloud instance metadata endpoints. The response is written to a temporary file and then passed to `sendImageMessage ...[truncated 1824 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · send.js (reported line 6)May include surrounding context.

js
const path = require('path');
const crypto = require('crypto');
const { program } = require('commander');
require('dotenv').config({ path: path.resolve(__dirname, '../../.env'), quiet: true });

// Optimization: Remove SDK, use shared client + caching (Cycle #0063)
const { getToken, fetchWithRetry } = require('../feishu-common/index.js');

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to send a local image file to Feishu but does not clearly disclose that the file contents will be uploaded to an external third-party service. This can lead users or downstream agents to transmit sensitive local files without informed consent, especially when the input path is user-controlled or automation is involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code uploads the selected image to Feishu and later sends a message using that uploaded content, which transmits user-provided data to an external service. While there are progress logs, there is no warning or confirmation that the image contents may leave the local system and that image keys are also cached locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill documentation advertises a --url option that will automatically download a remote image, but it does not warn users that invoking this option causes outbound network access and retrieval of attacker-controlled content. This can mislead users about the skill's behavior and increases the risk of SSRF-like misuse, unexpected connections to untrusted hosts, or processing of malicious remote files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation lists FEISHU_APP_ID and FEISHU_APP_SECRET as required environment variables but does not warn that these are sensitive credentials used to authenticate to the Feishu API. Without that warning, users may mishandle, log, or expose the secret during setup, increasing the chance of credential leakage and unauthorized API use.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret range (^1.6.0), which allows installation of newer compatible releases rather than a single reviewed version. This weakens supply-chain control and can unexpectedly introduce vulnerable or malicious upstream changes into the skill at install time.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "form-data": "^4.0.0"
  },
  "author": "OpenClaw",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

Axios has multiple known advisories, and because the manifest does not pin an exact version, it is not possible to verify whether deployed installs avoid affected releases. Given this skill's stated purpose of uploading and sending data to external Feishu endpoints, an axios issue could affect request integrity, credential handling, or enable SSRF-related abuse depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency uses a caret range (^4.0.0), so installs are not fully reproducible and may resolve to different package releases over time. In a package that handles uploads and external requests, this increases supply-chain exposure if a future dependency release contains a flaw or compromise.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
},
  "dependencies": {
    "axios": "^1.6.0",
    "form-data": "^4.0.0"
  },
  "author": "OpenClaw",
  "license": "ISC"

Unverifiable Dependency: form-data has 2 known advisory(ies) (CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Form-data has known advisories, and the unpinned manifest makes it impossible to determine whether installations will pull a safe release. Because the skill is intended to upload images, flaws in multipart boundary generation or header construction could become relevant in real request-building paths and increase request manipulation risk.

Content

No source excerpt is available for this finding.